Select Two (Multi-Select) Questions

Azure Backup vault names

Why wrong: Vault names are configuration details, not a log type that can be queried.

Virtual network address spaces

Why wrong: Address spaces describe networking, but they are not log records for analysis.

Managed disk size settings

Why wrong: Disk size is a resource property, not a log stream for Log Analytics.

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Why wrong: Delete is far too permissive for a support-only role. It would allow destruction of the virtual machine, which is explicitly not required and would create unnecessary risk. This option is the opposite of least privilege for routine operations.

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Why wrong: Starting or restarting a VM does not require permission to change the network interface. Granting NIC write access would broaden the role into network administration, which the requirement explicitly excludes. That would be excessive and unrelated to the task.

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Why wrong: Role assignment write permissions are administrative access-control rights, not VM operations. Including them would let the engineer modify authorization for many resources, which is not needed and would violate the requirement to avoid granting access-management capabilities.

Create a custom RBAC role that blocks resources deployed outside approved regions.

Why wrong: RBAC authorizes actions, but it cannot conditionally deny based on a resource property such as region.

Add a CanNotDelete lock to every resource group.

Why wrong: Locks prevent deletion or writes, but they do not validate required tags or allowed locations.

Grant User Access Administrator to the deployment team.

Why wrong: This only changes authorization capabilities and does not enforce deployment compliance rules.

Archived blobs can be read immediately through normal blob reads.

Why wrong: Incorrect. Archive data is offline, so a standard read fails until the blob is rehydrated.

Archive tier provides the fastest retrieval time.

Why wrong: Incorrect. Archive has the slowest retrieval behavior because data must first be restored online.

Changing a blob from Archive to Hot completes instantly and synchronously.

Why wrong: Incorrect. Archive rehydration takes time and is not an instantaneous synchronous tier change.

An application security group

Why wrong: An application security group is for network rules and has nothing to do with backup recovery.

A metric alert rule

Why wrong: A metric alert rule helps with monitoring, but it does not restore deleted files.

A user-assigned managed identity

Why wrong: A managed identity helps with authentication, but it is not required for file recovery.

Create the VMs manually in the Azure portal each sprint and document the clicks afterward.

Why wrong: Manual portal deployment is not source-controlled and is difficult to review or reproduce exactly. It is the opposite of a repeatable infrastructure-as-code process.

Export the resources after deployment and treat the export as the only authoritative source.

Why wrong: Exports can help with discovery, but they are not a strong primary design for repeatable deployment workflows. The repository should be the source of truth, not an after-the-fact export.

The VNet must already contain a private endpoint for on-premises connectivity.

Why wrong: Private endpoints are for PaaS access from Azure, not for establishing VPN tunnels from on-premises.

A network security group must be attached to the GatewaySubnet.

Why wrong: An NSG is not a prerequisite for deployment, and adding one can even complicate gateway traffic.

The VNet must use a service endpoint for Microsoft.Network.

Why wrong: Service endpoints are unrelated to VPN gateway provisioning and tunnel establishment.

Azure Bastion

Why wrong: Azure Bastion is used for secure VM access, not for monitoring or alert delivery.

A Recovery Services vault

Why wrong: A Recovery Services vault protects backups and restores, not metric-based alert notifications.

A resource lock

Why wrong: A resource lock prevents changes or deletion, but it does not generate monitoring alerts.

Create a new member user account with an internal password.

Why wrong: A member account with a local password defeats the requirement to use the consultant's existing work identity. It also introduces extra credential management and account lifecycle overhead.

Add the consultant to the Global Administrator role.

Why wrong: Global Administrator is far broader than necessary and would violate least privilege. The consultant needs access only to a specific resource group, not tenant-wide administrative rights.

Share the subscription ID and tenant ID only.

Why wrong: Subscription and tenant identifiers are not access controls. They may help the consultant find the environment, but they do not grant any authentication or authorization capability.

Assign the Reader role directly to every subscription under Corp.

Why wrong: This would work only after every subscription is configured individually. It also creates extra administrative work and does not automatically cover new subscriptions added later.

Assign the Reader role to the Auditors group at one resource group scope.

Why wrong: A resource group assignment is too narrow. It would not grant visibility across all subscriptions under the management group, only that single resource group.

Create an Azure Policy assignment to grant read access to all subscriptions.

Why wrong: Azure Policy evaluates compliance and controls configuration behavior, but it does not grant Azure RBAC permissions or provide read access.

Service principal with a client secret stored in an app setting.

Why wrong: A client secret is a stored credential and requires ongoing rotation and protection outside Azure identity management.

Shared administrator username and password stored in a Key Vault secret.

Why wrong: This still depends on a password-based credential and is not the preferred secret-free Azure identity approach.

SAS token generated once and reused indefinitely by both resources.

Why wrong: A long-lived SAS token is a secret and is not a robust identity choice for ongoing automation.

Restore the entire VM to a new VM and copy the file back manually.

Why wrong: That works for full-machine recovery, but it is unnecessary when only one file is missing and the VM must stay online.

Restore the disks from backup and attach them to the running VM.

Why wrong: Disk restore is a broader recovery option and is more disruptive than a file-only recovery workflow.

Use Azure Site Recovery failover to expose the file.

Why wrong: Site Recovery is for disaster recovery replication and failover, not for recovering an individual deleted file.

Place the VMs in the same availability set.

Why wrong: An availability set helps with host and update domain failures, but it does not protect against a full zone-level outage.

Use a proximity placement group for the VMs.

Why wrong: A proximity placement group improves latency by keeping resources close together, but it is not a resilience feature.

Use a snapshot of the operating system disk.

Why wrong: A snapshot helps with recovery, but it does not keep a running workload available during an outage.

Azure Virtual Machines

Why wrong: Requires guest OS management and is unnecessary for these needs.

Azure Kubernetes Service

Why wrong: Adds orchestration overhead that the container job does not need.

Azure Batch

Why wrong: Targets large-scale batch computing, not simple container or web hosting.

Assign the role at the rg-prod resource group scope.

Why wrong: Resource group scope would grant access to every resource inside rg-prod, which is broader than required.

Assign the role at the subscription scope.

Why wrong: Subscription scope would expose far more resources than the contractor should manage.

Assign the role at the management group scope.

Why wrong: Management-group scope is the broadest option here and would inherit into many subscriptions.

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Why wrong: LRS protects against local hardware failures, but all copies stay in one datacenter and one region.

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Why wrong: ZRS helps with a zone outage, but by itself it does not provide replication to another region.

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Why wrong: RA-GRS gives read access to the secondary region, but it does not provide zone redundancy in the primary region.

Apply a ReadOnly lock to the resource group.

Why wrong: ReadOnly blocks most write operations, which would interfere with updates, scaling, and other routine administration tasks. It is too restrictive for a production environment that still needs active maintenance.

Apply a CanNotDelete lock only to the individual virtual machines.

Why wrong: Locking only the virtual machines would leave the resource group itself and other resources deletable. The requirement is to protect the whole group and everything inside it during maintenance windows.

Use tags to mark the resources as production and prevent deletion.

Why wrong: Tags are useful for organization and reporting, but they do not enforce protection. They cannot block delete operations or change Azure behavior during maintenance windows.

Copy the blob directly while it remains in the Archive tier.

Why wrong: Archived data is offline, so a direct copy is not available until the blob has been rehydrated first.

Change the blob back to the Archive tier after the request starts.

Why wrong: Moving it back to Archive would keep the blob offline and would not help the team read it today.

Take a snapshot first and expect it to make the archived blob readable immediately.

Why wrong: A snapshot does not make an archived blob online; the base blob still has to be rehydrated before use.

Place all instances in a single availability set and scale them manually.

Why wrong: An availability set helps with host-level resilience, but it does not provide zone-level fault isolation. Manual scaling also misses the requirement for automatic instance growth during busy periods.

Deploy only one zonal VM and use snapshots to recover if the datacenter fails.

Why wrong: One VM is still a single point of failure, and snapshots do not provide active service continuity. The requirement calls for multiple instances and automated scaling, which a VM scale set supports.

Enable anonymous blob access

Why wrong: Anonymous access removes authentication and is not a secure network-restriction method.

Move the account to the Archive tier

Why wrong: Access tier selection does not control which networks can reach the storage account.

Apply a delete lock to the storage account

Why wrong: A lock helps prevent deletion, but it does not allow or restrict network connectivity.