Microsoft Azure Fundamentals AZ-900 (AZ-900) — Questions 976–983

Azure RBAC manages permissions to Azure resources (who can do what), but cannot enforce resource configuration like tags or approved regions. The question requires automatic enforcement of resource properties, which is a policy, not access control.

Azure Blueprints is used to orchestrate the deployment of resource templates and policy assignments, but it does not enforce compliance automatically; it requires manual deployment or updates. The question specifically asks for automatic enforcement without manual intervention, which is a core feature of Azure Policy.

Azure Management Groups organize subscriptions hierarchically but do not enforce resource-level rules like tagging or region restrictions. They lack the policy engine needed to automatically audit or enforce compliance requirements on deployed resources.

A question asking: 'Which service should be used to grant a specific team permission to deploy virtual machines only in the West Europe region?' In that case, RBAC with a custom role that denies deployment outside that region would be correct.

A company wants to define a repeatable set of Azure resources (e.g., a network topology, policies, and RBAC assignments) that can be deployed together as a single package across multiple subscriptions. Azure Blueprints would be the correct answer because it packages artifacts like policies, role assignments, and resource templates into a blueprint that can be assigned and updated centrally.

A company needs to centrally manage compliance and access policies across multiple subscriptions by grouping them under a single management hierarchy. For example, applying a policy that restricts subscription creation to certain departments or delegating administrative permissions at the management group level.

Candidates may confuse enforcement of rules (Policy) with controlling who can perform actions (RBAC), especially when the requirement involves 'enforcing' something, which sounds like access control.

Candidates may confuse Blueprints with Policy because both involve compliance and governance. Blueprints can include policy definitions, leading to the mistaken belief that Blueprints alone can enforce rules automatically, when in fact the enforcement comes from the included policies.

Candidates may confuse Management Groups with Policy because both operate at scale across subscriptions. They might think grouping subscriptions is sufficient to enforce rules, overlooking that Management Groups themselves do not enforce resource configurations.

Azure Logic Apps is a low-code integration service that uses connectors and workflows, not custom Python scripts. The requirement to run a custom Python script makes Logic Apps unsuitable, as it does not natively execute arbitrary code.

Azure Container Instances requires managing containers (though simplified) and incurs costs for running containers even when idle, not just when code executes. It does not natively trigger on Blob Storage uploads without additional components like Event Grid.

Azure Batch requires managing a pool of compute nodes and is designed for large-scale parallel batch processing, not for event-driven, serverless execution triggered by file uploads. It does not charge only when code executes and involves more management overhead.

A company needs to orchestrate a workflow that, upon file upload to Blob Storage, sends an email notification and copies the file to another container. The team wants a no-code solution with built-in connectors. In that case, Azure Logic Apps would be the correct answer.

A question where the team needs to run a custom Docker container for data processing, requires fast startup times, and wants to avoid managing underlying VMs but is okay with paying for container uptime (e.g., a batch processing job that runs for a few minutes).

A question where the team needs to run a large number of data processing tasks (e.g., thousands of CSV files) in parallel, with the ability to scale across many VMs, and they are willing to manage compute resources. For example: 'A company needs to process millions of image files using a custom tool, running on a cluster of VMs, with job scheduling and auto-scaling.'

Candidates may confuse Logic Apps' trigger-on-blob-upload capability with the ability to run custom code, not realizing Logic Apps is designed for workflow automation with pre-built connectors rather than executing arbitrary scripts.

Candidates may confuse 'serverless containers' with 'serverless functions', thinking Container Instances is serverless and can be triggered automatically, but it lacks built-in event-driven triggers and pay-per-execution pricing.

Candidates may confuse Azure Batch with serverless options because it can run custom scripts and is triggered by jobs, but they overlook its requirement for managing compute nodes and its cost model based on allocated VMs, not per execution.

Custom RBAC roles cannot override the Owner role's permissions, and even if they deny delete, the Owner role can modify or remove the role assignment, so it does not prevent subscription deletion by an Owner.

Azure Policy with 'Deny' effect can block creation or modification of resources based on properties, but it cannot prevent the delete action on the subscription itself; subscription deletion is controlled by Azure RBAC and resource locks, not Azure Policy.

A 'ReadOnly' lock prevents all modifications to resources, including changes to configurations and data, which is too restrictive. The question requires allowing modifications to resources inside the subscription while only preventing deletion of the subscription itself.

This option would be correct if the question asked for a solution to prevent a specific user (e.g., with Contributor role) from deleting a resource group or resource, but not the subscription, and the requirement was to use RBAC without affecting other users.

An administrator needs to enforce that all storage accounts in a subscription must use HTTPS only. Applying an Azure Policy with 'Deny' effect on the storage account resource type would block creation of non-compliant storage accounts.

A 'ReadOnly' lock at the subscription level would be correct in a scenario where the goal is to prevent any changes to all resources within the subscription, such as for a critical production environment that must remain static for auditing or compliance purposes.

Candidates may think that a custom role with explicit deny can block all users, including Owners, because they misunderstand that deny assignments in RBAC cannot override Owner permissions.

Candidates may confuse Azure Policy with resource locks, thinking that a 'Deny' effect can block any action including subscription deletion, because both are used to enforce restrictions.

Candidates may confuse 'ReadOnly' locks with 'Delete' locks, thinking that a read-only lock also prevents deletion, but they overlook that it blocks all modifications, not just deletion.

Azure Site Recovery allows replication to any Azure region, not just the paired region. The paired region is a default recommendation but not a requirement.

Azure Site Recovery allows replication to any Azure region, not just within the same availability zone. Availability zones are within a single region, not across regions, so this option incorrectly restricts region selection.

Azure Site Recovery allows replication to any Azure region, not just those within the same geography. The 'same geography' restriction applies to data residency requirements for certain services, but not to Site Recovery replication targets.

If the question specified that the company must use Azure Site Recovery's default settings and cannot modify the target region, then the recovery target would be limited to the paired region.

This option would be correct if the question asked about replicating virtual machines within the same Azure region for high availability, where Azure Site Recovery supports replication across availability zones in the same region.

If the question were about Azure SQL Database geo-replication or Azure Storage geo-redundant storage (GRS), which require paired regions within the same geography for automatic failover, then 'only to regions within the same geography' would be correct.

Candidates often confuse the default recommendation of paired regions with a hard requirement, especially since many Azure services use paired regions for redundancy.

Candidates may confuse availability zones with regions, thinking that cross-region replication is limited to zones, or they might mistakenly believe that Site Recovery requires both source and target to be in the same zone.

Candidates may confuse Site Recovery's flexibility with other Azure services that have geography-based restrictions, or they may overgeneralize data residency requirements to all disaster recovery scenarios.

Invoice is a billing document that summarizes charges for a billing period; it does not support creating alert rules based on cost thresholds for specific tags.

Cost analysis provides historical data and visualizations of costs but does not support proactive alerting or automated email notifications based on cost thresholds.

Recommendations provide optimization suggestions to reduce costs, but they do not support configuring email alerts based on cost thresholds for specific tags.

A company needs to download a PDF of their monthly charges for auditing purposes. They should use the Invoice feature in Cost Management + Billing to access and download invoices.

A question asks: 'Which Azure tool should be used to view a breakdown of current month spending by resource group and identify the top cost contributors?' In that scenario, Cost analysis is the correct feature for ad-hoc exploration and analysis of costs.

An organization wants to identify underutilized resources or get suggestions to reduce spending, such as rightsizing VMs or purchasing reserved instances. The question would ask: 'Which feature provides actionable insights to optimize cloud costs?'

Candidates may confuse 'Invoice' with cost monitoring because invoices show total costs, but they lack the alerting and filtering capabilities needed for this scenario.

Candidates may confuse cost analysis with budget alerts because both involve monitoring costs, but cost analysis is for reviewing past data, not setting proactive notifications.

Candidates may confuse recommendations with budget alerts because both relate to cost management, and recommendations are a prominent feature in Cost Management.