Virtual Machine practice questions

Recreate the virtual machines before the policy can evaluate them.

Why wrong: There is no need to recreate or redeploy the virtual machines because Azure Policy's Modify effect, combined with a remediation task, is designed to update existing resources in place without downtime. Recreating a VM may also fail to add the desired tag unless your deployment template explicitly includes the tag, and the new VM would still be evaluated from scratch. Policy evaluation is continuous and covers all resources, regardless of whether they were created before or after the assignment, so recreation is an unnecessary and ineffective workaround.

Change the effect from Modify to Audit to trigger the tag operation.

Why wrong: Changing the effect to Audit is logically incorrect because Audit does not perform any write operation—it only compares the resource's current tags against the policy rule and generates a compliance result. If you switch from Modify to Audit, Azure Policy will report the resources as non-compliant but will never attempt to add the costcenter tag. This would solve the original problem (applying the tag) by removing the mechanism that could apply it, making the situation worse.

Azure Policy

Why wrong: Azure Policy is a governance service that enforces organizational rules and compliance by applying policies at resource creation or update time, such as requiring specific VM sizes or tags. While it can deny or audit non-compliant resources, it does not analyze historical CPU, memory, or network usage patterns to identify underutilized VMs. Its purpose is to ensure resources conform to standards, not to provide cost or performance optimization recommendations based on telemetry.

Network Watcher

Why wrong: Network Watcher is focused on network-level diagnostics, providing tools like IP flow verify, connection troubleshoot, NSG diagnostics, and packet capture to help identify connectivity and security rule issues. It does not evaluate compute resource utilization such as CPU or memory percentage, nor does it assess whether a VM is underutilized from a compute perspective. Its metrics and logs are network-centric and do not cover overall VM performance optimization.

Azure Backup

Why wrong: Azure Backup is a data protection service that performs scheduled backups of VMs and other workloads, enabling restore and disaster recovery capabilities. It tracks backup health, recovery points, and retention but does not monitor ongoing compute utilization or cost efficiency of running VMs. Since its objective is safeguarding data and ensuring recoverability, it is unrelated to analyzing VM utilization for optimization recommendations.

Create a log alert rule based on the VM's performance counters collected in Log Analytics.

Why wrong: Creating a log alert rule based on the VM's performance counters collected in Log Analytics is wrong for this scenario because log alerts depend on performance data being ingested into a Log Analytics workspace, which requires the Azure Monitor agent and diagnostic settings. This adds complexity and latency compared to a metric alert, which directly evaluates the VM's built-in platform metric. While log alerts are useful for complex cross-resource queries, they are not the optimal or most direct method for a single critical VM's CPU threshold alert.

Enable Azure Diagnostic Settings on the VM to send performance data to a storage account.

Why wrong: Enabling Azure Diagnostic Settings on the VM to send performance data to a storage account is wrong because diagnostic settings to a storage account are intended for archival, export, or compliance, not for real-time alerting. This action alone does not generate any alert; you would still need to create a log alert or external processing to analyze the stored data. For immediate CPU notification, a metric alert on the automatically available platform metric is the appropriate and efficient choice.

Configure an Application Insights availability test to monitor the VM's CPU.

Why wrong: Configuring an Application Insights availability test to monitor the VM's CPU is wrong because availability tests are designed to monitor the external reachability and response latency of HTTP/HTTPS endpoints, not server-side CPU utilization. They require a public URL and an agent to ping the endpoint from global locations, and they cannot read CPU metrics from an Azure VM. CPU monitoring belongs in Azure Monitor metrics, while availability tests belong to Application Insights web monitoring.

az vm start: Stops a running virtual machine.

Why wrong: This option is incorrect because 'az vm start' performs the opposite action: it starts a VM, not stops it. Stopping a running VM is the role of 'az vm stop'. Furthermore, 'az vm start' would fail or be a no-op if executed against a VM that is already stopped, as its operation is to power on, not power off, the virtual machine.

az vm stop: Deallocates a virtual machine.

Why wrong: This option is incorrect because 'az vm stop' shuts down the VM but intentionally maintains its allocation of compute resources, which means billing continues. Deallocating a VM, which releases those compute resources and stops compute charges, requires the separate command 'az vm deallocate'. The subtle but critical distinction is that 'stop' preserves the host lease while 'deallocate' relinquishes it.

Assign a system-assigned managed identity to each VM.

Why wrong: A system-assigned identity is bound to one VM, so it cannot be shared cleanly across multiple machines.

Create a storage account access key and place it in each VM's application settings.

Why wrong: Sharing storage keys increases risk and does not satisfy the requirement to avoid secrets.

Create a separate SAS token for each VM and rotate it manually.

Why wrong: SAS tokens are limited-time secrets and do not provide the shared, identity-based access pattern requested.

An availability set with two VMs

Why wrong: An availability set with two VMs only protects against hardware failures and planned maintenance by distributing VMs across fault and update domains, but it does not automatically change the number of running VMs. It provides high availability with a fixed, manually managed capacity, so it cannot handle sudden increases in web traffic. Additionally, there is no built-in mechanism to grow or shrink the VM count, making it unsuitable for elastic scaling.

A single VM with a larger disk

Why wrong: A single VM with a larger disk does not provide horizontal scaling, and increasing disk size only affects storage capacity, not compute throughput or the ability to handle more concurrent requests. Even if you resized the VM to a larger SKU, this would be vertical scaling, which still leaves a single point of failure and cannot elastically adapt to traffic fluctuations. The stateless web app requires multiple identical VMs that can be added or removed, not more storage space.

An Azure Policy assignment to increase CPU capacity

Why wrong: An Azure Policy assignment cannot increase CPU capacity because Azure Policy is a governance and compliance service that enforces rules on resources, such as tagging or location restrictions. It does not perform real-time scaling actions, alter VM sizes, or change processor allocation. Policies can evaluate and remediate resources, but they are not an autoscaling solution and cannot respond to changing workload demands.

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

Why wrong: RBAC role definitions authorize actions such as Microsoft.Compute/virtualMachines/write, but they cannot inspect the request body or evaluate properties like the selected SKU. A custom role cannot "exclude unsupported VM sizes" because size is a deployment parameter evaluated by Azure Policy, not an RBAC permission. Even with full Contributor equivalent write permissions, an RBAC-only approach will still allow an operator to deploy any VM SKU if no policy denies it.

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

Why wrong: A CanNotDelete lock is an Azure management lock that protects resources from deletion, not from creation or update. It functions at the resource/management level and does not validate or constrain configuration values such as VM size during a PUT operation. Applying CanNotDelete to a resource group would block deleting the group and its resources, but it would do nothing to stop an administrator from deploying a VM with a non-approved SKU.

Assign Reader permissions to the operators and rely on Azure portal validation.

Why wrong: Assigning Reader permission would revoke all write capabilities, so users could not deploy any virtual machine at all—far exceeding the intent of blocking only unsupported VM sizes. Relying on Azure portal validation is also not an enforceable control because it exists only in the portal UI; any call through Azure CLI, PowerShell, or the REST API can bypass portal warnings and submit a compliant deployment. The requirement is to actively deny disallowed SKUs, which requires an Azure Policy definition and assignment, not a restrictive RBAC role or a user-facing UI guard.

Place the VMs in an availability set instead of using a scale set.

Why wrong: An availability set is designed for high availability by distributing VMs across fault domains and update domains, but it does not include any built-in mechanism to automatically add or remove VMs. If the workload grows, an administrator must manually create and attach new VMs; likewise, reducing capacity requires manual deallocation. While an availability set improves resilience, it fails the core requirement of automatic scaling based on CPU utilization, so it is not a substitute for a VM scale set in this scenario.

Clone the VM manually whenever CPU rises and remove clones by hand later.

Why wrong: Manually cloning a VM whenever CPU rises and removing clones by hand is operationally fragile and violates the requirement for automatic scaling. Manual actions are slow relative to load changes, prone to configuration drift because cloned instances must be individually updated, and offer no centralized monitoring or safe scale-in logic. This approach also requires continuous human attention and lacks the integration with autoscale policies that a purpose-built VMSS provides, making it both inefficient and unreliable for a dynamic workload.

A private endpoint for the storage account.

Why wrong: A private endpoint would give the storage account a private IP and usually changes the access pattern away from the public endpoint.

A site-to-site VPN connection to the storage account.

Why wrong: VPN connects networks, not individual PaaS service access paths, and is unnecessary here.

An application security group assigned to the storage account.

Why wrong: Application security groups are for NICs in NSG rules, not for securing Azure Storage.

ReadOnly lock, because it prevents all changes and keeps resources fully protected.

Why wrong: ReadOnly is too restrictive because it blocks write operations as well as deletions. The scenario says administrators must still be able to update settings, so a ReadOnly lock would prevent legitimate management tasks and break the requirement.

No lock is needed because Azure RBAC already prevents deletion by default.

Why wrong: Azure RBAC does not block deletion by default; it only grants or denies permissions based on assigned roles. A user holding a role such as Contributor or Owner has the authority to delete resources unless an explicit deny assignment is in place. Resource locks function as an authoritative restriction that overrides RBAC for all users, protecting the resource group from accidental deletion even when administrators need update permissions.

Management group lock, because all changes in the tenant must be blocked centrally.

Why wrong: Management groups are for organizing subscriptions and applying governance at a high level, but the question is about protecting one resource group. A management group lock is not the right concept here and would be far broader than required.

A static private IP address for each backend VM.

Why wrong: Static private IP addresses ensure the backend VMs keep stable addresses, but an NSG rule that references individual IPs still requires one rule per VM, or a range that may be brittle as the tier grows or shrinks. When backend VMs are rebuilt frequently, their NICs might be recreated, and even with static IPs you must track and manage address assignments manually. Static IPs do not group VMs logically or reduce rule maintenance; they only avoid DHCP changes, while an ASG provides a role-based target that stays constant regardless of IP changes.

A user-defined route pointing frontend traffic to the backend subnet.

Why wrong: A user-defined route (UDR) controls the next hop for packets, not which traffic is permitted or denied. Pointing frontend traffic to the backend subnet would simply change the forwarding path and could even break asymmetric routing, but it does not create an authorization boundary. NSG rules require a source, destination, and port scope; a UDR cannot reference a logical group of backend VMs, so it is fundamentally the wrong mechanism for replacing ASG-based targeting.

A private endpoint for the backend tier.

Why wrong: A private endpoint is a PaaS construct that exposes an Azure service (such as Storage or SQL Database) over a private IP address inside a virtual network; it is not a grouping mechanism for IaaS VMs. You cannot attach a private endpoint to a subnet as a source or destination in an NSG rule to represent a workload tier. Concepts like private endpoints are relevant for network-level isolation of Azure services, not for authorizing traffic to a set of backend VMs, so using one here is a category error.

Restore the entire VM to the original resource group.

Why wrong: Restoring the entire VM to the original resource group may overlap with the existing VM's name, IP addresses, or managed disks, causing restoration failures or requiring you to delete or rename the current VM. Even if you choose 'create new VM', you are restoring all disks and the full operating system when only one file is missing, which dramatically increases restore time. File-level recovery is the least invasive option because it mounts just the disk from the recovery point so you can copy out the specific file.

Create a new backup policy with longer retention and wait for the next backup.

Why wrong: Changing backup retention does not retroactively affect existing restore points; retention policies only govern how long new backups are kept. The missing file is already present in the current recovery point, so you can launch a file recovery immediately without waiting for another backup. Postponing recovery increases the risk of additional data loss and is unnecessary, because the recovery point already contains the exact file you need.

Use Azure Monitor alerts to trigger an automatic file restore.

Why wrong: Azure Monitor alerts are designed to notify on conditions such as resource health or metric thresholds; they have no native built-in action to execute an Azure Backup file recovery. While an action group could theoretically trigger an automation runbook that calls Backup REST APIs, that is custom engineering, not a supported out-of-box recovery mechanism. The intended and supported path to retrieve a single file is to use Azure Backup's 'File Recovery' option from an available recovery point.

An availability set

Why wrong: An availability set is a logical grouping of VMs that spreads instances across fault domains and update domains to protect against hardware failures and maintenance downtime, but it has no scaling logic — it neither monitors demand nor changes the number of running VMs. You must manually add or remove VMs from the set. Therefore, while it improves resiliency, it cannot satisfy the automatic scale-out/in requirement for identical stateless VM instances.

Azure Load Balancer

Why wrong: Azure Load Balancer is a Layer 4 network component that distributes inbound traffic to a backend pool of existing VMs and uses health probes to remove unresponsive instances from rotation, but it has no knowledge of capacity or demand and cannot create, delete, or scale VM instances. It may be paired with a scale set to route traffic, but the load balancer itself never triggers scaling operations. Hence, it addresses traffic distribution, not lifecycle management of identical VMs.

Azure App Service

Why wrong: Azure App Service is a fully managed PaaS offering that runs web apps, API apps, and mobile backends, not raw VM instances; even though its App Service Plan supports autoscale rules based on metrics or schedules, the underlying compute is a shared or dedicated app service plan that abstracts away VM identities and fault domain placement. The question specifically calls for identical VM instances and VM-centric fault domain behavior, which App Service cannot expose. Thus, while autoscaling is built in, it applies to the wrong hosting model.

Assign the role at the rg-prod resource group scope.

Why wrong: Assigning the role at rg-prod scope grants the contractor permission on every resource contained in that resource group, including any network interface (NIC), disk, network security group, or other VM not equal to VM1/VM2. While this is more contained than subscription scope, it still exceeds the requirement because the contractor would be able to manage all current and future resources placed in rg-prod. Resource-group scoped RBAC assignments do not provide object-level filtering; they apply uniformly to every resource within the resource group. Thus it is wrong because the requested minimal access scope is per-VM, not per-resource-group.

Assign the role at the subscription scope.

Why wrong: A role assignment at subscription scope cascades to all resource groups and resources within the subscription, meaning the contractor would gain management rights over every VM, network interface, storage account, and other resource in rg-prod and any other resource group. This violates the explicit 'only vm1 and vm2' requirement because subscription-scoped assignments override any narrower assignments and cannot be restricted to a subset of resources. Even with conditional access or additional deny assignments, subscription scope is far too broad and would expose unrelated Azure resources.

Assign the role at the management group scope.

Why wrong: Management group scope propagates the role assignment down to every subscription in the management group's hierarchy, covering potentially thousands of resources across multiple subscriptions. This is the broadest type of Azure RBAC scope and would grant the contractor full management capabilities on VMs and other services far outside rg-prod. Because management group hierarchy can include rg-prod only as a tiny subset, this scope is unjustifiably expansive. It is incorrect for the same reason as broader scopes generally but specifically because it cascades across subscriptions and management groups.

A custom RBAC role that removes the create action for virtual machines.

Why wrong: A custom RBAC role that removes the create action for virtual machines (Microsoft.Compute/virtualMachines/write) is an identity-based control: it determines who can perform the action, not whether the resulting resource satisfies a required tag. If assigned, it would block all VM creation by those users, even compliant deployments, and it provides no compliance reporting or auditing of non-compliant resources. Additionally, RBAC cannot evaluate resource properties like tags, so it fails to enforce the specific governance requirement of tagging at deployment time.

A resource lock on the resource group.

Why wrong: A resource lock prevents accidental deletion or modification of a resource group or its resources at the management plane level, typically using CanNotDelete or ReadOnly. It does not inspect the resource payload for tags or evaluate any compliance rules. A lock would simply block all deletion or mutation operations, not specifically those missing a required tag, and it cannot enforce the presence of a tag during initial creation because locks are applied only to existing resources. This is a protective measure, not a governance validation tool.

An Entra ID dynamic group for the VM creators.

Why wrong: Entra ID dynamic groups automatically manage user membership based on properties like department or location, but they are unrelated to resource configuration or tagging. Group membership affects token claims and conditional access, not how the VM is deployed in Azure Resource Manager. A dynamic group could not intercept an ARM deployment request to validate a required cost-center tag, nor could it deny the deployment based on missing metadata. Therefore, it has zero effect on ensuring the tag requirement is met.

A Recovery Services vault policy

Why wrong: A Recovery Services vault policy governs backup and restore operations, not compute capacity. It defines retention ranges, backup frequency, and point-in-time recovery settings for Azure VMs or other protected workloads. While it might indirectly help recover a failed instance, it has no relationship to the VM Scale Set's instance count or scaling logic. Therefore, configuring a Recovery Services vault policy would never cause instances to be added automatically in response to load.

Boot diagnostics

Why wrong: Boot diagnostics captures serial console output and screenshots of a VM's startup process to assist with troubleshooting boot failures. It stores those logs in a managed storage account and can be viewed via the Azure portal or Azure CLI. Although boot diagnostics are often enabled on VM Scale Set instances for operational visibility, they are a telemetry and debugging tool only. They contain no logic to evaluate metrics, trigger scale events, or alter the number of running instances, so they cannot satisfy the requirement to add instances automatically.

Azure Advisor only

Why wrong: Azure Advisor is a recommendation service that analyzes resource configurations and usage patterns to suggest best practices for cost, performance, reliability, and security. For example, it might recommend enabling autoscale on a VM Scale Set or changing instance sizes, but it does not perform any actions on your behalf unless you manually accept and implement the recommendation. Advisory recommendations, even if followed, only lead to the creation or modification of an actual autoscale rule; Advisor alone never adds or removes instances. Thus, Azure Advisor cannot directly provide automatic instance scaling without the underlying Azure Monitor autoscale configuration.

Assign the role directly to each operator at the resource group scope.

Why wrong: Assigning the role to each user's Entra ID object individually is functionally valid RBAC, but it fails the efficiency and lifecycle requirement. Every membership change (hire, transfer, departure) becomes a manual task: an admin must locate and delete each stale assignment, and forgetting one leaves an ex-employee with access. Group-based assignment, by contrast, binds permissions to membership, so removing a user from the group revokes their assignments automatically. This option also multiplies administrative overhead and does not leverage Entra ID group management.

Assign Virtual Machine Contributor to the team at the subscription scope.

Why wrong: Virtual Machine Contributor is a built-in role that grants create, delete, start, stop, and extension management permissions—far more than the read and restart the operators need. Applying it at subscription scope extends that excess across every resource group and resource in the subscription, violating least privilege and expanding blast radius. Even if the team were a group, the combination of a broad role and top-level scope fails the requirements stated in the scenario.

Use a resource lock and add the operators as lock owners.

Why wrong: A resource lock is an Azure management control that protects resources from deletion or modification—it does not authorize anyone to perform actions. The ReadOnly lock mode would actually block restart operations because restart submits a write request to the VM, so operators could not do their job. Stakeholders cannot be given permission by being lock owners; locks have no concept of ownership for access purposes, and lock assignments do not sync with Entra ID group membership. This option confuses protection with authorization.

Route tables can be associated directly to a single virtual machine without using its subnet.

Why wrong: Route tables cannot be associated directly to a single virtual machine. Azure only permits the association of a route table to a subnet, and every VM in that subnet shares the same effective routes. If you need different routing for a specific VM, you must create a separate subnet with its own route table and place the VM there, rather than attaching the table to the VM.

A user-defined route automatically overrides a network security group deny rule.

Why wrong: User-defined routes govern the next hop for packets, while network security groups enforce allow/deny rules on traffic. A UDR cannot change the outcome of an NSG deny; if an NSG rule denies traffic, the traffic is dropped before it can be routed to the next hop. The two must be designed together, but routing never overrides security filtering.

System routes are never used when a route table exists.

Why wrong: System routes, such as those for local virtual network traffic, internet-bound traffic, and gateway connections, are always present and evaluated alongside user-defined routes. Azure uses prefix matching to choose the most specific route; if no UDR matches a destination, the associated system route is still used. UDRs can only override system routes that have a matching prefix, and some system routes, like the local VNet route, can be overridden but not deleted entirely.

Assign the Virtual Machine Contributor role to the operations group.

Why wrong: The Virtual Machine Contributor built-in role grants a broad set of VM management permissions, including the ability to create, delete, start, stop, and restart virtual machines, as well as manage their disks and network interfaces. This role goes well beyond the required read and restart actions and would allow the operations team to make changes that are not permitted in the least-privilege model. Additionally, it can enable a user to grant another user access to the VM, which is an unnecessary security risk in this scenario.

Create an Azure Policy assignment that denies VM creation in the resource group.

Why wrong: Azure Policy is a governance mechanism that enforces rules on resource configurations during creation or update; it does not grant permissions to perform existing resource operations. A policy denying VM creation would only prevent new VMs from being deployed and would have no effect on whether an existing VM can be restarted. Restart authorization is controlled solely by RBAC actions, so the operations team would still lack the required Microsoft.Compute/virtualMachines/restart/action permission.

Apply a ReadOnly lock to the resource group.

Why wrong: A ReadOnly lock is an Azure resource lock that prevents any user from performing write operations on the resource group, regardless of their RBAC role assignments. Restarting a VM is a control-plane write operation that issues a POST to Microsoft.Compute/virtualMachines/restart, so it would be blocked by the lock. The lock would also block other management tasks like starting, stopping, or deleting resources, thus the operations team would be unable to perform the required restart action at all.

The allow rule wins because subnet NSGs always override NIC NSGs.

Why wrong: Subnet NSGs and NIC NSGs do not have a hierarchical relationship where one overrides the other; Azure evaluates both scopes independently for every packet. Within a single NSG, rules are processed by priority number, but that priority does not apply across NSGs. A subnet NSG allow rule cannot supersede a NIC NSG deny rule, nor can a NIC NSG allow rule override a subnet NSG deny. The effective result is that traffic must be allowed by both layers — a deny at either scope blocks the traffic.

The traffic is allowed because service tags bypass NIC-level rules.

Why wrong: Service tags are just logical groupings of Azure service IP prefixes that can be used as source or destination in an NSG rule; they are a convenience for writing rules, not a bypass mechanism. A service tag–based allow rule in one NSG still requires that the other NSG also permit the traffic. If the NIC-level NSG has a deny rule (or the subnet NSG denies), the service tag's allow rule in the other scope does not prevent the packet from being dropped. The tag never exempts traffic from evaluation at any other NSG scope.

The connection succeeds unless a route table sends the traffic elsewhere.

Why wrong: A route table only determines the next hop for traffic based on the destination IP, such as sending it to a virtual appliance or VPN gateway; it does not alter NSG permit/deny decisions. Network security groups are evaluated before the packet is forwarded according to the effective route, and a matching deny rule will block the packet before it can leave the subnet. Therefore, the presence of a custom route has no bearing on whether a deny rule in either NSG causes the connection to fail — the connection succeeds only if the route is valid AND both NSG layers allow the traffic.