CCNA Manage Azure Identities and Governance Questions

Assigning policies to individual resource groups does not automatically apply to new subscriptions; the question requires automatic application to future production subscriptions, which demands assignment at a management group scope, not resource groups.

Tags do not automatically apply policy definitions to new subscriptions; they are metadata on resources. Policies must be assigned at a management group or subscription scope to affect new subscriptions.

Resource locks prevent accidental deletion or modification but do not enforce policy definitions. The question requires automatic application of a governance package to new subscriptions, which resource locks cannot achieve.

Removing the policy assignment from Corp-MG would disable the tag requirement for all subscriptions under that management group, weakening enforcement for the entire organization, which contradicts the requirement to allow only this single deployment to proceed.

Changing the policy effect from Deny to Audit for all assignments would weaken enforcement across the entire organization, which contradicts the requirement to allow only this single deployment to proceed without weakening enforcement for the rest.

Moving Prod-Sub out of Corp-MG would remove all inherited policies from that management group, weakening enforcement for the entire subscription, not just the single deployment. The goal is to allow one deployment to proceed without affecting the rest of the organization.

Option C stores the storage account access key in the app configuration, which violates the requirement to avoid storing a shared key, SAS token, or password. The question explicitly requires a solution without storing such secrets.

Option D is wrong because embedding a SAS token in application code violates the requirement to avoid storing a shared key, SAS token, or password. The question explicitly prohibits using any such credentials.

Moving the VM into a different subnet does not provide any mechanism for the app to authenticate to Azure Storage without credentials. It only changes network isolation, not identity or access control.

The security team explicitly prohibits storing any password, certificate, or client secret in application settings, and a service principal with a client secret stored in App Service configuration violates this requirement.

A shared access signature (SAS) is used for granting delegated access to Azure Storage resources, not for authenticating an App Service to Key Vault. It does not provide an identity that can be automatically removed when the app is deleted.

ReadOnly lock prevents all changes, including resizing VMs and changing settings, which contradicts the requirement that administrators must still be able to modify resources.

Contributor is an Azure RBAC role, not a lock. It allows full management access, including deletion, so it does not prevent accidental deletion.

Azure Policy is used to enforce organizational standards and assess compliance, not to prevent accidental deletion of resources. It does not provide a lock that blocks delete operations.

ReadOnly lock prevents all write operations, including updating VM sizes and tags, which contradicts the requirement to allow those updates.

Applying CanNotDelete on the management group would block deletion of all resource groups under that management group, but the question only requires preventing deletion of a single production resource group. Additionally, it does not address the need to allow updates to VM sizes and tags, which is already permitted with CanNotDelete at the resource group level.

An Azure Policy deny assignment can block updates to VM sizes and tags, which contradicts the requirement that administrators still need to update those properties.

RBAC assignments on a resource group are inherited by all resources within that group, including those created after the assignment, so the user would have Reader access to the new storage account.

The Reader role only allows read access, not write access. Contributor access requires a role assignment that includes write permissions, which is not inherited from the Reader role.

The Reader role on a resource group grants read-only access to all resources within it, including new resources, but does not grant Owner or full control. Owner access requires an explicit role assignment at the resource or higher scope.

Local user accounts in resource groups are not supported in Azure; user accounts are managed at the tenant level in Microsoft Entra ID, not per resource group. Creating a local account would also require managing separate credentials, contradicting the requirement to use the developer's existing work account.

A managed identity is an Azure resource identity used for authenticating to Azure services without storing credentials, not for inviting external users. It cannot be used to grant access to a partner's existing work account.

A service principal is an identity for applications or automated tools, not for individual users. The question requires granting access to a specific developer using their existing work account, which is a user-to-user collaboration scenario, not an application identity scenario.

User-assigned managed identity does not automatically disappear when the VM is deleted; it must be manually deleted separately, failing the requirement for automatic cleanup.

A service principal with a client secret requires storing a secret on the VM, which violates the constraint of not storing credentials. Additionally, it does not automatically disappear when the VM is deleted.

A shared access signature (SAS) is used to grant delegated access to Azure Storage resources, not to authenticate to Azure Resource Manager APIs. It cannot serve as an identity for a VM to call ARM APIs.

A resource group is not a scope for policy or RBAC assignment that applies automatically to multiple subscriptions; it only applies to resources within that specific resource group, not to all production subscriptions.

Tags are not inherited by default and require explicit assignment to each resource; they cannot automatically apply a baseline policy or RBAC assignment to all production subscriptions now and in the future.

A single production subscription with multiple resource groups does not automatically apply policies and RBAC assignments to future production subscriptions; it only covers one subscription, not multiple separate subscriptions.

Assigning two separate policies manually to each subscription is inefficient and does not provide a single compliance view for both rules. It also skips remediation, so missing tags on existing resources would not be corrected.

Assigning Contributor at the management group scope grants broad permissions to modify resources but does not enforce governance rules or provide a compliance view; it relies on manual fixes and does not automate compliance or remediation.

A CanNotDelete lock prevents resource deletion but does not enforce tagging or allowed locations, and it cannot provide a compliance view or remediate missing tags.

Azure Policy, not RBAC, is the correct tool to enforce allowed locations. A custom RBAC role can deny deployment actions, but it cannot prevent resource creation by other services or at the subscription level, and it doesn't integrate with Azure Policy's compliance reporting.

CanNotDelete locks prevent resource deletion but do not restrict deployments to approved regions or enforce tagging, which are the specific requirements in the question.

Granting User Access Administrator allows the team to manage role assignments, which is not needed for preventing deployments in unsupported regions or enforcing tags; Azure Policy handles these controls declaratively without granting additional RBAC permissions.

A separate system-assigned managed identity on each VM would require managing two identities and recreating role assignments for each new VM, failing to meet the requirement of sharing the same access without managing secrets or recreating role assignments when a VM is replaced.

Storing an administrator username and password in a script introduces secrets management overhead and security risks, and does not eliminate the need to update credentials or role assignments when a VM is replaced.

A shared access signature (SAS) assigned to the virtual network provides delegated access to storage resources, not identity-based access to VMs. It cannot be used to grant VMs access to Azure resources without managing secrets, and it does not persist across VM replacements without manual updates.

Removing the policy assignment would disable the deny effect for all resources in the subscription, including those that should remain protected, violating the requirement to keep the policy enforced for other storage accounts.

Changing the effect to Audit would allow all storage accounts in the subscription to bypass the deny policy, not just the legacy one, violating the requirement to block public access for other accounts.

Moving the storage account to a separate subscription would require reconfiguring network access and potentially disrupt the migration. The policy is assigned at the subscription level, so moving to a new subscription would avoid the policy but does not address the requirement to keep the account publicly reachable for 30 days without migration interruption.

Assigning Reader at each subscription scope would require creating one assignment per subscription, which contradicts the requirement to avoid creating one assignment per subscription. It also does not cover future subscriptions automatically.

Assigning Reader at one resource group per subscription does not grant access to all resources in the subscription, only to that specific resource group. The requirement is for Reader access to all current and future subscriptions, not just a single resource group per subscription.

Locks are used to prevent accidental deletion or modification of resources, not to grant access. A lock does not provide Reader permissions; it only restricts operations regardless of the user's role.

A system-assigned managed identity is tied to the lifecycle of a single VM. If that VM is deleted, the identity is also deleted, so it cannot persist across VM recreations or be shared with another VM.

A service principal with a client secret stored on each VM requires manual secret management and rotation; if a VM is deleted, the secret is lost, and the identity cannot persist across VM recreations without manual intervention.

Certificates uploaded to each VM are not managed identities; they require manual rotation and secure storage, and if a VM is deleted and recreated, the certificate must be re-uploaded, breaking the identity continuity.

A system-assigned managed identity is tied to the lifecycle of each VM; if a VM is deleted and recreated, its identity is lost and must be reassigned, failing the requirement that the identity persists across VM deletion and recreation.

A local administrator account is tied to a specific VM instance and does not persist if the VM is deleted and recreated. It also cannot provide a single identity for multiple VMs to access Azure resources.

An Azure Blueprint assignment is used to define a repeatable set of Azure resources and policies for compliance, not to assign an identity to VMs for accessing resources. It cannot provide a consistent identity that persists across VM deletion and recreation.

Assigning Reader at each subscription separately does not cover future resources in new subscriptions added to the management group, violating the requirement for access to all current and future resources.

Assigning Reader at a single resource group would not grant access to all resources across five subscriptions, failing the requirement for read-only access to every current and future resource in all five subscriptions.

Assigning Reader directly to each resource is impractical and does not scale; it fails to cover future resources and violates the requirement for read-only access to all current and future resources across five subscriptions.

Resource groups are organizational containers within a single subscription, not across subscriptions. They cannot be used to centrally target policy assignments across multiple subscriptions, as policies applied to a resource group only affect resources within that specific subscription's resource group.

The error is caused by an Azure Policy denying public IP creation, not by a lack of permissions. Assigning Owner would grant more privileges than needed and violates the constraint to keep the Contributor role unchanged.

Moving the VM to another management group does not bypass Azure Policy assignments, which are inherited from management groups. The policy blocking public IPs would still apply in the new management group unless that group has a different policy exemption.

Assigning at the management group scope would grant permissions to all subscriptions and resources within that management group, far exceeding the requirement to restrict access to only VM-App01.

Assigning the role at the resource group scope would grant the engineer permissions to all resources within that resource group, including other VMs, storage accounts, and network resources, violating the requirement to restrict access only to VM-App01.

Assigning the role at the subscription scope grants permissions to all resources in the subscription, including other VMs, storage accounts, and network resources, which violates the requirement to restrict access only to VM-App01.

Modify effect automatically changes non-compliant resources, but the requirement is to block creation in disallowed regions and only report missing CostCenter tags without remediation.

DeployIfNotExists is used to deploy resources (like a policy remediation task) when a non-compliant resource exists, but the requirement is only to report (non-blocking) missing CostCenter tags, not to automatically deploy a tag or resource.

The Disabled effect turns off a policy definition entirely, so it cannot block resource creation in restricted regions or generate a nonblocking report of untagged resources.

Assigning Contributor on the subscription grants the service desk broad Azure resource permissions, which violates the requirement that they must not receive Azure subscription permissions.

User-assigned managed identity persists independently of the VM lifecycle; it does not disappear when the VM is deleted, failing the requirement that the identity disappears with the VM.

A storage account shared key provides full access to the storage account and does not disappear when the VM is deleted; it persists until manually rotated or deleted, and it is not an identity tied to the VM lifecycle.

SAS tokens stored in a startup script do not automatically disappear when the VM is deleted; they persist in the script or storage, and they require manual management, unlike managed identities which are tied to the VM lifecycle.

A system-assigned managed identity is tied to the lifecycle of the Automation account; when the account is recreated, a new identity is created, breaking the association with existing role assignments and requiring reassignment.

The question requires that the identity continue to work after the automation account is recreated without reissuing credentials. A service principal with a client secret stored in Key Vault would require reissuing the secret or updating the runbook's reference after recreation, violating the 'without reissuing credentials' constraint.

A shared access signature (SAS) token is used for delegated access to Azure Storage resources, not for authenticating runbooks to Azure resources in general. It does not support the identity lifecycle requirement of surviving Automation account recreation without reissuing credentials.

Audit only logs non-compliant resources but does not block creation. The question requires blocking creation of new resources without the tag, which only Deny can enforce.

Append adds the missing tag to non-compliant resources but does not block creation; it only remediates after the fact, whereas the requirement is to block creation of untagged resources.

The 'Disabled' effect deactivates the policy, meaning it does not block or audit resources; thus it cannot prevent creation of untagged resources.

Deleting the policy assignment would remove enforcement from all resources, not just the legacy storage account, violating the requirement that compliance reporting must continue to show the policy as enforced everywhere else.

A read-only lock prevents modifications to the storage account but does not exempt it from the policy that denies public network access; the policy would still block public access, making the account unreachable.

Assigning a custom RBAC role to the application team does not exempt the storage account from the policy; the policy still denies public network access, and RBAC roles control permissions, not policy compliance.

In Azure RBAC, permissions are additive and inherited from higher scopes. The Contributor role assigned at the resource group scope is inherited by all resources within that group, including the storage account, overriding the Reader role from the subscription for that resource.

Azure RBAC permissions are inherited from resource group scope to resources within that group, so the Contributor role assigned at RG-Web scope is inherited by the storage account inside RG-Web, not requiring a direct assignment.

Azure RBAC does not automatically merge roles into a new custom role. Permissions are additive: the effective permissions are the union of all assigned roles, not a merged custom role.

The CanNotDelete lock prevents deletion but still allows modifications to existing resources, which does not satisfy the requirement to block all changes during the freeze.

The Reader role allows viewing resources but does not block modifications; it only prevents changes by users without contributor/owner permissions, not by administrators or automated processes. The question requires blocking all changes, which ReadOnly lock provides.

DeployIfNotExists is a policy effect, not a lock. It triggers a remediation task to deploy a resource if one doesn't exist, but it does not block changes to existing resources, which is the requirement here.

An initiative does not grant permissions; Azure RBAC roles are used for granting permissions. Initiatives are for grouping and assigning policy definitions, not for access control.

An initiative does not replace resource group locks; it groups policy definitions for assignment. Resource group locks are a separate Azure governance feature that prevents accidental deletion or modification.

An initiative is a group of policy definitions, not a tool for creating resource groups. Resource groups are created via Azure Resource Manager templates, CLI, or portal, not through policy initiatives.

A SAS token is tied to a specific storage account and can be revoked or expire, but it is not an Azure identity that can be assigned to VMs. It does not persist independently of VMs and cannot be used as a shared identity across multiple VMs that remains available if one VM is deleted.

A system-assigned managed identity is tied to a single VM and is deleted when that VM is deleted, so it would not remain available if one VM is removed.

A storage account shared key provides full access to the storage account and is not tied to a specific identity; it cannot be scoped to only the VMs and would remain valid even if a VM is deleted, but it does not meet the requirement of using an Azure identity for the batch app.

The question asks for non-compliance with an assigned policy, which is specifically tracked in Azure Policy compliance view. Entra ID users and groups manage identity and access, not policy compliance.

The Resource locks blade is used to prevent accidental deletion or modification of resources, not to check policy compliance. Non-compliant resources are identified in the Azure Policy compliance view.

A system-assigned managed identity is tied to the lifecycle of a single VM; if the VM is rebuilt, the identity is deleted and recreated, breaking the RBAC role assignment on the storage account. The question requires the identity to persist across VM rebuilds.

A storage account shared key embedded in application settings is not secure and does not support identity reassignment; if a VM is rebuilt, the key must be re-deployed, and it cannot be easily reassigned to future VMs without creating a new credential.

A service principal credential stored in Key Vault requires managing a secret and rotating it, and if the VM is rebuilt, the application must retrieve the secret again, which adds complexity and a dependency on Key Vault availability. The question requires a single identity that can be reassigned to future VMs without creating another credential, which user-assigned managed identity fulfills more directly.

Azure RBAC role assignments manage permissions for users/groups, not guardrails like policies. The question asks for deploying and managing guardrails (policy rules) as a unit, which requires an initiative, not RBAC.

Applying a ReadOnly lock to each subscription prevents accidental deletion or modification of resources but does not deploy or manage guardrails (policies) as a unit; it is a separate control mechanism, not a policy construct.

Moving all resources into one resource group does not deploy or manage guardrails as a unit; it only consolidates resources without enforcing any policies or compliance rules.

The script cannot store a password or client secret, and interactive username/password login is not suitable for unattended execution. Additionally, Azure CLI's 'az login' with username/password requires interactive input or storing credentials, which violates the constraint.

Device code authentication requires interactive user input (browser login), but the script runs unattended every night, so it cannot complete the device code flow without human intervention.

The script cannot store a password or client secret, so using an app registration secret stored in a PowerShell variable violates that constraint. Additionally, secrets require secure storage and management, which is not feasible in an unattended script without credential storage.

Assigning Reader at the subscription scope for Sub-001 only grants access to that specific subscription, not to every current and future subscription under Corp. The requirement is for automatic access to all subscriptions, which requires assignment at the management group scope.

Assigning Reader at the resource group scope does not grant access to every current and future subscription under Corp; it only covers specific resource groups within a single subscription, failing to meet the requirement for automatic access across all subscriptions.

Assigning Reader at the resource level would require manual assignment to each resource, failing to provide automatic access to all current and future subscriptions under Corp. It does not scale and violates the principle of least privilege by granting access at too granular a level.

A user-assigned managed identity persists independently of the VM lifecycle; it does not disappear automatically when the VM is deleted, failing the requirement that the identity should disappear automatically.

A storage account access key is a static credential that must be stored on the VM, violating the requirement to not store credentials on the VM, and it does not automatically disappear when the VM is deleted.

Azure Policy is used to enforce compliance rules on resources, not to grant permissions. It cannot allow a user to perform actions like restarting a VM; it only evaluates and enforces conditions.

A CanNotDelete lock prevents deletion of the VM but does not grant permissions to restart it or read its properties; it only blocks delete operations, not controls access.

Moving a VM to a management group does not grant specific permissions like restart or read properties; it only changes the scope for policy and compliance inheritance, not role-based access control.

Resource groups organize resources within a subscription but do not enforce governance across multiple subscriptions or automatically apply rules to new subscriptions. The question requires automatic application of governance to new production subscriptions, which management groups provide.

A CanNotDelete lock prevents deletion of a subscription but does not enforce governance policies like tagging, RBAC, or compliance rules across multiple subscriptions automatically.

Custom roles assigned to subscription owners do not automatically apply to new subscriptions; each new subscription would require manual role assignment, failing the requirement for automatic governance.

Granting Contributor at the subscription scope does not enforce tagging or location restrictions; it grants broad permissions to manage resources, not block noncompliant deployments.

Applying a CanNotDelete lock prevents deletion of resource groups but does not enforce tagging or restrict deployment locations, which are the requirements in this question.

A local administrator password would be stored on the VM, violating the requirement to not store credentials. It also does not provide Azure AD authentication for Azure CLI commands.

A network security group (NSG) rule controls inbound/outbound traffic to a VM, not authentication for Azure CLI commands. It cannot provide credentials or identity for creating Azure resources.

An Azure region paired with the VM is used for disaster recovery and geo-redundancy, not for authentication. It does not provide any identity or credential to authorize Azure CLI commands.

Direct role assignment per operator requires manual updates when operators leave or new VMs are added, failing the automatic access removal and inheritance requirements.

Assigning Virtual Machine Contributor at the subscription scope grants excessive permissions (e.g., ability to manage all VMs across all resource groups) and does not restrict access to only reading properties and restarting VMs in one resource group. It also does not automatically remove access when an operator leaves, as the role is assigned directly to the team rather than through a group.

Resource locks prevent accidental deletion or modification of resources but do not grant access permissions; they cannot provide the read and restart permissions required for the operators.

Adding the contractor directly to the subscription Owner role bypasses the PIM eligibility workflow and violates the principle of least privilege; it does not address the requirement to activate the eligible role assignment.

Azure Policy compliance evaluation does not affect role activation; the deployment fails because the PIM-eligible role must be activated first, not because of policy evaluation.

Removing and re-adding the user does not activate the PIM-eligible role; the role remains inactive until the user activates it through PIM and meets the policy requirements.

Assigning the Reader role at each subscription scope under Prod requires maintaining separate assignments for each new subscription, which contradicts the requirement to avoid manual maintenance.

Assigning the Reader role at the Corp management group scope would grant read-only access to all subscriptions under both Prod and Sandbox, violating the requirement that the auditor must not see resources in Sandbox.

Assigning the Reader role at one resource group in each Prod subscription does not grant access to all current and future resources in the entire subscription, only to that specific resource group. It also requires maintaining separate assignments for each new subscription, violating the requirement to avoid that.

The Contributor role at subscription scope grants full management access to all resources in the subscription, which is far broader than the required permissions to restart VMs and read network interface settings in a single resource group.

The Reader role grants read-only access, but the automation tool needs to restart VMs, which requires write permissions (e.g., Microsoft.Compute/virtualMachines/restart/action). Reader cannot perform restart operations.

The Network Contributor role only grants permissions for network resources, not for restarting VMs (which requires compute permissions like Microsoft.Compute/virtualMachines/restart/action).

A ReadOnly lock prevents any modifications, including updates, to resources. The question requires that resources can still be updated but not deleted, so a ReadOnly lock is too restrictive.

A subscription lock applies to the entire subscription, not just the resources in the exhibit. The question asks for a lock that allows updates but prevents deletion of specific resources, which is the CanNotDelete lock at the resource or resource group scope.

A management group lock applies to all subscriptions within the management group hierarchy, not to individual resources. The question asks for a lock that allows updates but prevents deletion of specific resources, which is the CanNotDelete lock at the resource or resource group scope.

Storing a service principal secret in a protected file violates the security policy that forbids storing passwords, certificates, or access tokens on the VM. Managed identity eliminates the need for any stored credentials.

The question requires the application to read secrets from Key Vault without storing credentials on the VM. A user-assigned managed identity not assigned to the VM cannot be used by the VM to authenticate; the identity must be assigned to the VM to be used.

SSH certificates authenticate the user or system to the VM for SSH access, not the application to Azure Key Vault. The application needs an Azure AD identity to access Key Vault secrets, which SSH certificates cannot provide.

Assigning Reader to RG-Web only grants read access to resources within that specific resource group, not to all current and future resources in the Sales subscription. The requirement is to read every resource in the Sales subscription, which requires subscription-level scope.

Assigning Reader to the Corp management group would grant read access to all subscriptions under that management group, including the Research subscription, which violates the requirement to not grant access to Research.

Assigning Reader to each resource individually would require manual updates for every new resource, failing to meet the requirement to read every current and future resource without granting access to the Research subscription. It also violates the principle of least privilege by not leveraging inheritance.

Assigning Reader to the compliance analyst's user account at each resource group fails to cover future resources and is inefficient; it also doesn't meet the requirement to view all resources across all production subscriptions.

Assigning Reader to one subscription does not cover other production subscriptions; inheritance only applies within the same hierarchy, not across sibling subscriptions.

Assigning Reader directly to each resource is inefficient and violates the principle of least privilege by requiring individual assignments for every resource, which does not scale and does not cover future resources. The question requires viewing all current and future resources, which is best achieved at the management group scope.

A Reader role assignment grants read-only access to resources but does not prevent deployment in disallowed regions; it only limits management operations, not resource creation.

A CanNotDelete lock prevents deletion of resources but does not restrict deployment to specific regions. The question asks to block deployment in disallowed regions, which requires a policy, not a lock.

A tag requirement enforced only by resource group naming does not block deployment in disallowed regions; it only enforces naming conventions, not regional restrictions.

Applying governance controls individually to each new subscription is not automated and does not scale, failing to meet the requirement that all production subscriptions inherit the baseline automatically.

A resource lock prevents accidental deletion or modification of a subscription, but it does not enforce governance baselines like policies or RBAC across multiple subscriptions. It cannot automatically inherit settings to new subscriptions.

Placing all resources into one shared resource group per business unit does not automatically inherit governance baselines across subscriptions; it only groups resources within a single subscription, failing to address the requirement for automatic inheritance across multiple production subscriptions.

Reassigning the policy at the resource group scope only does not trigger evaluation or remediation of existing resources; it only changes the assignment scope, leaving existing VMs non-compliant.

The Modify effect already adds tags; switching to AuditIfNotExists would only audit compliance without remediating existing non-compliant VMs, failing to bring them into compliance.

Manually tagging only the newest VMs does not address the policy's requirement to tag all existing resources; the Modify effect requires a remediation task to apply tags to non-compliant resources automatically.

Azure RBAC role assignments control permissions to perform actions on resources, but they cannot enforce restrictions on which Azure regions can be used to create resources. RBAC does not have a built-in capability to deny region-specific resource creation.

A CanNotDelete resource lock prevents deletion of resources but does not restrict resource creation to specific Azure regions. It cannot enforce regional constraints across subscriptions.

Tag inheritance rules only propagate tags from a management group to subscriptions or resources; they do not enforce region restrictions or deny resource creation in disallowed regions.

Azure RBAC manages access permissions to resources, not enforcement of tags. The question describes a deployment failure due to a missing required tag, which is a compliance check enforced by Azure Policy, not RBAC.

Resource locks prevent deletion or modification of resources but do not enforce tagging requirements. The question specifies that deployment is blocked due to a missing required tag, which is enforced by Azure Policy, not resource locks.

Azure Monitor is a monitoring and diagnostics service, not a policy enforcement service. It cannot block deployments due to missing tags; that is the role of Azure Policy.

Creating one subscription per virtual machine is impractical and violates Azure subscription limits (max 10,000 VMs per subscription) and cost reporting best practices; subscriptions are not granular enough for per-app reporting.

Resource names are not guaranteed to be unique across subscriptions or resource groups, and they lack the structured querying and filtering capabilities of tags, making them unreliable for accurate cost reporting.

Placing all applications in one management group does not provide per-application cost reporting or isolate access for each app team; management groups are for policy and compliance inheritance, not granular RBAC or cost allocation.

A system-assigned managed identity is tied to the VM's lifecycle and cannot be shared across subscriptions. The script needs to access resources in another subscription, which requires a cross-subscription identity like a user-assigned managed identity.

The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image, making secret management impractical and insecure. Option C requires storing a secret, violating the constraint.

A shared access signature (SAS) is used to delegate access to Azure Storage resources, not to authenticate an Azure CLI session or manage identities across subscriptions. It cannot sign CLI sessions or grant permissions to create and tag resources.

Assigning Reader directly to the contractor's user object at the subscription scope grants read-only access to all resources in the subscription, not just the application resource group, violating the principle of least privilege. The requirement is for read-only access to a single resource group, not the entire subscription.

Assigning Contributor at the resource group scope grants write permissions, which violates the requirement for read-only access. Relying on discipline is not a secure or auditable access control method.

A resource lock prevents accidental deletion or modification of resources but does not grant read-only access; it only protects existing permissions. The contractor still needs a role assignment to access resources, so a lock alone is insufficient.

A shared local account on the VM would require storing credentials (username/password) on the VM, which violates the requirement to avoid storing passwords or client secrets. Managed identities provide a password-free authentication method.

An Azure Policy exemption is used to exclude specific resources from policy evaluation, not to provide authentication credentials for a script to create resources.

A public IP address is used for network connectivity, not for authentication or authorization. It does not eliminate the need for storing credentials, as the script would still require secrets to authenticate to Azure.

The Sandbox-MG is designed for non-production workloads and does not apply the production governance baseline (e.g., policies, RBAC) that the question requires.

Creating a resource group does not enable inheritance of governance baselines like policies or RBAC from a management group; governance inheritance requires placing the subscription under a management group.

Moving the subscription to the tenant root does not automatically inherit any governance baseline; it only places it at the top level without any management group hierarchy. The question requires automatic inheritance of the production governance baseline, which is achieved by placing the subscription under Prod-MG, not the tenant root.

Assigning at subscription scope grants permissions to all resource groups in the subscription, not just RG-App, violating the requirement to limit access to RG-App only.

Assigning the role at the management group scope would grant permissions to start/stop VMs in all subscriptions under that management group, not just RG-App, violating the requirement to restrict access to only RG-App.

Assigning the role to a single VM would only grant permissions on that VM, not on all VMs in RG-App, and the requirement is to manage all VMs in the resource group.

Assigning Reader at each resource group fails to cover future subscriptions and resources not in those resource groups, violating the requirement for access to all current and future subscriptions under the management group.

Assigning at one subscription scope only grants access to that single subscription, not to all 12 current subscriptions or any future ones under the management group.

Assigning Reader at a single resource scope in one subscription does not grant access to other subscriptions or future subscriptions under the management group, failing to meet the requirement for all current and future subscriptions.

A Contributor role assignment grants broad management permissions but does not enforce tagging rules or block noncompliant resources; it cannot prevent deployment of untagged resources or report on compliance.

A resource lock prevents deletion or modification of resources but does not enforce tagging requirements or block creation of noncompliant resources. It cannot report noncompliant resources or deny deployment of untagged resources.

A custom RBAC role with tag write permissions allows users to add tags but does not enforce a policy to block noncompliant resources or report existing noncompliant resources. Azure Policy with deny effect is required to enforce tagging rules and generate compliance reports.

A storage account access key grants full control over the storage account and must be stored in code or configuration, violating the requirement to avoid storing secrets.

A shared access signature (SAS) token is a secret that must be stored in code or configuration, which contradicts the requirement to avoid storing secrets.

A local administrator account on the VM cannot authenticate to Azure Storage; it only provides local OS access, not Azure resource access.

A system-assigned managed identity is tied to the lifecycle of a specific VM; if the VM is rebuilt, the identity is deleted and recreated, so it cannot be reused across rebuilds or shared among multiple VMs.

A service principal with a certificate file copied to each VM requires manual certificate management and rotation, and the identity is tied to the VM's certificate file, not reusable if the VM is rebuilt without the same certificate.

A shared access signature (SAS) provides delegated access to a specific storage account or Key Vault but is not an identity that can be reused across VMs; it is a token tied to a resource, not an Azure AD identity, and does not support the requirement of a single reusable identity.

The question requires the identity to continue working after the Automation account is recreated. A service principal with a client secret stored in an encrypted variable still ties the secret to the account lifecycle; if the account is recreated, the variable is lost, and the secret must be re-created. Additionally, embedded secrets are explicitly disallowed.

A system-assigned managed identity is tied to the Automation account lifecycle; when the account is deleted and recreated, the identity is also deleted and recreated with a new principal ID, breaking RBAC role assignments that were made to the old identity.

Storage account keys are long-lived secrets that must be managed and rotated, violating the requirement to avoid embedded secrets. They also do not automatically work after the Automation account is recreated, as the key would need to be re-stored in the new account.

Assigning roles directly to each user account requires editing role assignments for every joiner and leaver, which contradicts the requirement to avoid frequent edits.

Guest accounts are for external collaboration, not for managing internal team members. They do not simplify role assignment management for frequent joiners/leavers because each guest still needs individual role assignments or group membership.

A service principal is an identity for applications or automated tools, not for human users. Assigning roles to a service principal shared by the team would not manage human joiners/leavers and could lead to security risks and lack of auditability.

A ReadOnly lock prevents all write operations, including updates to VM settings, tags, and network rules, which the operations team still needs to perform.

Assigning the Reader role allows read-only access but does not prevent deletion; operators could still delete resources if they have other permissions, and it blocks all write operations, which contradicts the requirement to update VM settings, change tags, and modify network rules.

Azure Policy deny assignments prevent non-compliant resource creation or modification, but they do not block deletion of existing resources. The question requires preventing deletion while allowing updates, which is achieved by a CanNotDelete lock, not a policy.

Three separate policy assignments at each subscription scope would require managing multiple assignments per subscription, contradicting the requirement for a single assignment and consolidated compliance reporting across all subscriptions under the management group.

A resource lock prevents deletion or modification of resources but does not enforce compliance policies like allowed regions, tags, or VM SKUs. It cannot provide consolidated compliance reporting.

Custom RBAC roles control permissions to Azure resources, not compliance policies like allowed regions, tags, or VM SKUs. They cannot enforce or audit configuration requirements across subscriptions.

Assigning Reader access to individual user accounts would require editing each user's permissions to revoke access, contradicting the requirement to manage access via group membership changes.

A management group is used to organize and manage access, policies, and compliance across multiple Azure subscriptions, not to assign roles to individual users within a single resource group. It cannot be used to grant Reader access to specific operators by changing group membership.

A resource lock prevents accidental deletion or modification of resources but does not grant access permissions. It cannot be used to assign Reader access to users.

The contractor has an eligible role requiring activation via PIM, not a direct assignment. Role propagation delay does not apply because the role is not active; it must be activated first.

Creating a new security group and assigning Contributor directly would not resolve the issue because the contractor's role is eligible and requires activation through Privileged Identity Management (PIM), not a new group assignment.

Signing out and back in does not resolve the issue because the contractor's role is eligible, not active. The portal error indicates the role requires activation through Privileged Identity Management (PIM), not a session refresh.

Assigning Reader at subscription scope grants read access to all resources in the subscription, violating the requirement that the engineer must not access other resource groups.

The Contributor role includes write permissions beyond restarting and viewing properties, such as deleting resources or creating new ones, which violates the least privilege principle required by the question.

Assigning a custom role at subscription scope would grant permissions across all resource groups, violating the requirement that the engineer must not access other resource groups.

A system-assigned managed identity is tied to a single VM and cannot be reused across multiple VMs; it is created and deleted with the VM, not centrally removable.

A service principal with a client secret requires storing and managing a secret, which contradicts the requirement to avoid storing passwords. It is also not reusable across VMs in a centralized, removable way like a managed identity.

A local administrator account is tied to a single VM, cannot be reused across multiple VMs, and requires password management, which contradicts the requirement for a centrally removable identity without storing passwords.