Hard Difficulty Questions

A metric alert on storage capacity with an action group.

Why wrong: Capacity metrics do not indicate platform outage conditions or regional service health events.

A log alert on storage diagnostic logs that watches for 503 responses.

Why wrong: This depends on continuous log collection and may miss the platform-level health signal the team wants.

An Azure Policy assignment that audits the storage account state.

Why wrong: Policy can report compliance, but it does not notify operators about live availability incidents.

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Why wrong: Delete is far too permissive for a support-only role. It would allow destruction of the virtual machine, which is explicitly not required and would create unnecessary risk. This option is the opposite of least privilege for routine operations.

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Why wrong: Starting or restarting a VM does not require permission to change the network interface. Granting NIC write access would broaden the role into network administration, which the requirement explicitly excludes. That would be excessive and unrelated to the task.

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Why wrong: Role assignment write permissions are administrative access-control rights, not VM operations. Including them would let the engineer modify authorization for many resources, which is not needed and would violate the requirement to avoid granting access-management capabilities.

Use a blob container and mount it through the Blob API

Why wrong: Blob containers are object storage, not shared file systems, and they do not provide the same SMB file-share experience.

Use anonymous access on an Azure File share

Why wrong: Anonymous access is not appropriate for a secured enterprise file share and would not satisfy the access control requirement.

Use a premium NFS file share with a shared access signature

Why wrong: NFS does not provide the same Windows-and-AD-DS file-sharing model, and a SAS is a secret-based access mechanism that violates the key restriction.

Create a custom RBAC role that blocks resources deployed outside approved regions.

Why wrong: RBAC authorizes actions, but it cannot conditionally deny based on a resource property such as region.

Add a CanNotDelete lock to every resource group.

Why wrong: Locks prevent deletion or writes, but they do not validate required tags or allowed locations.

Grant User Access Administrator to the deployment team.

Why wrong: This only changes authorization capabilities and does not enforce deployment compliance rules.

A custom RBAC role assigned at the tenant root

Why wrong: RBAC governs permissions, not which resource types are allowed.

A ReadOnly lock on each subscription

Why wrong: A ReadOnly lock would block many changes but does not selectively restrict resource types.

A budget alert for each subscription

Why wrong: Budget alerts monitor cost and do not enforce deployment standards.

Availability zones

Why wrong: Availability zones improve resiliency but do not adjust instance count based on CPU.

Azure Policy

Why wrong: Azure Policy enforces governance rules, not runtime scaling actions.

Update management

Why wrong: Update management coordinates patching and not autoscaling.

Apply a ReadOnly lock to each resource group.

Why wrong: Locks prevent changes to resources but do not restrict deployment locations.

Create an action group in Azure Monitor.

Why wrong: Action groups handle notifications and automated actions for alerts, not regional deployment governance.

Move all existing VMs to approved regions.

Why wrong: That is unnecessary because the requirement allows existing noncompliant VMs to remain.

A service endpoint on the subnet and a storage account firewall rule for the subnet.

Why wrong: Service endpoints do not create a private IP address and do not change DNS to a private endpoint address.

Allow trusted Microsoft services on the storage account and keep the public endpoint enabled.

Why wrong: Trusted Microsoft services is not private VNet connectivity and does not provide a private IP or private DNS resolution.

Create a public DNS record that maps the blob FQDN to the storage account's public IP address.

Why wrong: A public record would defeat the requirement for private-only name resolution inside the VNet.

Service principal with a client secret stored in an app setting.

Why wrong: A client secret is a stored credential and requires ongoing rotation and protection outside Azure identity management.

Shared administrator username and password stored in a Key Vault secret.

Why wrong: This still depends on a password-based credential and is not the preferred secret-free Azure identity approach.

SAS token generated once and reused indefinitely by both resources.

Why wrong: A long-lived SAS token is a secret and is not a robust identity choice for ongoing automation.

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

Why wrong: The UDR is broader, but a more specific system route to the peered VNet can take precedence.

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

Why wrong: This destination is explicitly covered by a more specific peering route, so Internet is not chosen.

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

Why wrong: UDRs and peering can coexist, and Azure still selects the most specific valid route.

NSG flow logs

Why wrong: NSG flow logs show allowed and denied flows rather than the active routing table.

Azure Advisor recommendations

Why wrong: Advisor does not display effective route entries.

Diagnostic settings for the activity log

Why wrong: Activity log diagnostics capture control-plane operations, not active NIC routing.

Replace the metric alert with a diagnostic setting and store the data in Log Analytics.

Why wrong: Diagnostic settings collect data; they do not suppress notifications during a time window.

Lower the alert threshold so fewer alerts occur during the week.

Why wrong: Changing thresholds alters detection logic, not the notification schedule, and can hide legitimate issues.

Use an autoscale profile instead of an alert rule.

Why wrong: Autoscale can respond to demand, but it does not provide a business-hours notification filter for an existing alert.

A Recovery Services vault

Why wrong: Recovery Services vaults are for backup and recovery.

Azure Network Watcher

Why wrong: Network Watcher is focused on network diagnostics rather than centralized VM log analytics.

A load balancer

Why wrong: A load balancer distributes traffic and does not store log data for KQL queries.

VPN Gateway with point-to-site configuration

Why wrong: A VPN would require client configuration on each laptop, which the requirement explicitly rejects.

A public load balancer with inbound NAT rules

Why wrong: That would expose management ports to the internet, which the security team does not allow.

A NAT gateway attached to the VM subnet

Why wrong: A NAT gateway supports outbound internet access only and does not provide inbound administrative access.

NSG flow logs

Why wrong: NSG flow logs show allowed and denied traffic flows, not the effective routing table.

Azure Policy compliance

Why wrong: Policy compliance does not show routing decisions.

The subscription activity log

Why wrong: The activity log records control-plane events, not the effective route entries applied to a NIC.

NSG flow logs

Why wrong: NSG flow logs show allow or deny outcomes for traffic, not the route table applied to the NIC.

Azure Policy compliance

Why wrong: Policy compliance does not show active routing entries.

The subscription activity log

Why wrong: The activity log records control-plane changes and not the effective route list.

NSG flow logs

Why wrong: NSG flow logs show allowed and denied traffic flows, not the effective route table.

Azure Policy compliance

Why wrong: Policy compliance does not show routing information.

Activity log

Why wrong: The activity log shows control-plane events, not active route entries on a NIC.

A Recovery Services vault

Why wrong: A Recovery Services vault handles backup and recovery rather than centralized log analytics.

Azure Network Watcher

Why wrong: Network Watcher focuses on network diagnostics and is not the main platform for general VM log analytics.

A load balancer

Why wrong: A load balancer distributes traffic and does not store monitoring data.

Rehydrate the blob to Cool tier by using Standard priority.

Why wrong: This eventually restores access, but Standard priority is not the fastest choice when time is critical.

Copy the blob into another Archive tier container and wait for replication.

Why wrong: Copying to another Archive location does not make the data readable sooner and adds no value.

Change the storage account redundancy to ZRS so the blob becomes accessible faster.

Why wrong: Redundancy settings do not affect Archive rehydration time or restore archived blob readability.

Assign the role at the rg-prod resource group scope.

Why wrong: Resource group scope would grant access to every resource inside rg-prod, which is broader than required.

Assign the role at the subscription scope.

Why wrong: Subscription scope would expose far more resources than the contractor should manage.

Assign the role at the management group scope.

Why wrong: Management-group scope is the broadest option here and would inherit into many subscriptions.