CCNA Describe Azure management and governance Questions

A custom RBAC role allows you to define a precise set of allowed actions. By including only the start, deallocate, and restart actions, you grant exactly the permissions needed. The role does not include write or delete actions, so developers cannot create or delete VMs. Since VNet and database actions are not included, those resources are also protected. This meets the least privilege requirement.

A 'CanNotDelete' resource lock prevents deletion of the resource group and its resources but still allows modifications to the resources within. This lock is scoped to the specific resource group, so it does not affect other resource groups.

The Azure Compliance Documentation and Trust Center are the official Microsoft sources that enumerate Azure's regulatory compliance offerings, including certifications such as ISO/IEC 27001, SOC 1/2/3, HIPAA, GDPR, and FedRAMP. These materials provide detailed whitepapers, audit reports, and attestation letters explaining how Azure meets each standard's requirements. For a question about which standards Azure itself satisfies, the Trust Center is the correct reference.

Correct. The Modify effect is designed to add, change, or remove tags and other properties on resources. It can be applied during resource creation or update and supports remediation tasks to bring existing non-compliant resources into compliance. This makes it the best fit for the scenario.

Correct. Azure Service Health provides a personalized view of the health of Azure services, regions, and resources you actually use. It includes alerts for planned maintenance, service issues, and health advisories, and offers a historical incident report. It is the native Azure solution for this requirement.

Azure Policy's DeployIfNotExists effect is evaluated during resource creation and update operations, and if the SQL database lacks diagnostic settings, the policy engine automatically deploys the linked ARM template to configure them. This happens without human intervention because the policy is assigned at a management group or subscription scope and the effect is an immutable part of the policy definition. It also provides a compliance dashboard, remediation tasks, and can be extended to existing databases.

Azure Policy is the correct answer because it is the native Azure governance service that evaluates resource creation and update requests in real time against rule definitions. Policies can enforce tagging by using effects such as 'deny' (blocking resource creation if required tags are missing), 'append' (automatically adding a tag with a default value), or 'audit' (logging non-compliant resources). For example, the built-in policy 'Require a tag and its value on resources' ensures every new resource is created with the specified tag, and you can assign it at subscription or management group scope to make the enforcement consistent across all new resources.

An Azure Policy initiative, also known as a policy set, bundles multiple related policy definitions into a single assignable object. When assigned at a scope such as a subscription or resource group, all included policies are evaluated together, and compliance results are aggregated for the entire initiative. This grouping simplifies management and helps enforce broad regulatory frameworks like HIPAA or FedRAMP as one unit.

This is correct. By default, Azure Blueprints do not actively manage resources after they are deployed. When the blueprint assignment is updated, only the resources defined in the blueprint are added or modified; manually added resources that are not in the blueprint remain unchanged.

This option is correct. Azure AD B2C is Microsoft's customer identity and access management (CIAM) service, specifically built for consumer-facing applications. It allows end users to sign up, sign in, and manage profiles using local accounts (email/password) or social identity providers like Google, Facebook, and Apple, and it issues tokens that applications can use without requiring a workforce directory. This makes it the right choice for authenticating external customers, not internal employees or services.

A 'CanNotDelete' resource lock is a management-level safeguard that explicitly prevents any user or role, including Subscription Owner, from deleting the database or server. Unlike RBAC, it applies independently of permissions, and because it allows read, update, and scale operations, it does not interfere with normal administration or schema changes. Locking both the database and the server is important because resource locks are not automatically inherited from a server to its databases in every scenario, and a lock on the resource group alone would not offer this specific, targeted protection.

Azure Blueprints is designed to define a repeatable set of Azure resources and policies that can be deployed together as a single, versioned artifact. It orchestrates the deployment of ARM templates, policy assignments, role assignments, and other artifacts to ensure new subscriptions meet corporate baselines.

Secure Score provides a quantified measurement (0 to 100) of your security posture by assessing the implementation status of security controls in Microsoft Defender for Cloud. Each recommended control has a maximum number of points, and you earn points by remediating those recommendations. It gives actionable, prioritized improvements to reduce risk across your Azure resources, which is exactly the purpose described.

Azure AD Conditional Access with device compliance is correct because it enforces policies that require a device to be marked as compliant by Intune before access is allowed to applications. This combines identity signals with device health signals, enabling real-time enforcement of security posture. It is the native Azure AD mechanism for conditionally managing access based on device state.

Correct. A management group can contain multiple subscriptions, and any policies or role assignments applied at the management group level are automatically inherited by all child subscriptions.

This option correctly describes what happens on eligible subscriptions (such as Free Trial or plans with monthly credits) when the spending limit is hit. Azure disables the subscription, and any running virtual machines are stopped and deallocated — the VM loses its allocated compute resources, and the lease on the underlying physical hardware is released. The subscription remains in this suspended state until you either remove the spending limit (after which you pay for any overage) or the limit resets at the start of the next billing cycle.

The Modify effect in Azure Policy can add, update, or remove tags (or other properties) on resources at creation or during remediation. For this scenario, a policy definition with the Modify effect would include an operation to add the 'CostCenter' tag with a default value, automatically applying it to resources without blocking the deployment. Because the modification happens transparently as part of the resource creation process, the resource is created successfully with the tag already in place, making this the correct choice.

Correct. RBAC enables granular access management by assigning roles that include specific permissions (such as Microsoft.Compute/virtualMachines/write) to users or groups. By ensuring only the 'VM Operators' group has a role that allows creating VMs, and by using a deny assignment to block all others, the security team can enforce the requirement.

Azure Advisor is a free, personalized cloud consultant that continuously analyzes your Azure subscriptions and resource configurations, then provides best-practice recommendations across cost, security, reliability, and performance. It scores each recommendation by potential impact and offers one-click implementation from the portal. For example, it might suggest right-sizing underutilized VMs, enabling geo-redundant storage, or removing unassociated public IP addresses. This makes Advisor the correct service for the stated 'personalized optimization recommendations'.

Azure Cost Management Cost Analysis is the dedicated tool for exploring and visualizing your actual cost data, offering interactive charts that break down spending by resource group, service, or tag over time. It also includes a forecast engine that uses historical usage patterns to estimate your expected spend for the next 30 days, allowing both trend review and future planning. This combination of historical analytics and forecasting directly fulfills the requirement, making it the correct answer.

Microsoft Defender for Cloud's Regulatory Compliance dashboard (also available in Azure Security Center) provides exactly the needed pass/fail monitoring against specific regulatory standards, including ISO 27001, PCI DSS 3.2.1, NIST SP 800-53, SOC 2, and Azure CIS 1.1.0/1.3.0. It continuously evaluates connected Azure and hybrid resources, maps assessment results to each standard's control requirements, and shows which controls are passing or failing. You can select the standards you need, view per-control results, track history, and export evidence, making it the superior tool for regulatory compliance in Azure.

Updating the assignment is the supported way to apply a newer published blueprint version to the management groups and subscriptions already in scope. The assignment stores a reference to the exact version; changing that reference to the latest published version triggers a reconciliation that deploys newly added artifacts and updates existing ones without deleting the target resources.

A policy with DeployIfNotExists effect is the correct choice because it can deploy an Azure Resource Manager template that adds the required tags to resources when they are created or updated. For already-deployed resources, the policy can be assigned and a remediation task can then be run to initiate the deployment and bring those existing resources into compliance. This gives continuous enforcement plus the ability to retrofit non-compliant resources, which is exactly what 'ensure all Azure resources' requires.

Azure Management Groups are the correct answer because they let you build a hierarchy of subscriptions, and any Azure Policy or RBAC assignment applied at a management group level is inherited by every subscription beneath it. New subscriptions placed into that management group automatically receive the same governance and compliance settings without requiring per-subscription configuration. This inheritance model directly addresses the need for consistent policy enforcement across multiple subscriptions, including those added later.

Azure Blueprints allows you to define a repeatable set of Azure resources, policies, and role assignments that implements organizational standards. Blueprints can be versioned, published, and assigned to subscriptions, and when updated, the changes can be applied to existing assignments. This exactly meets the requirement for a reusable, centrally managed governance package.

Azure Policy is the correct service because it can define rules that evaluate resource properties, including tags, at creation, update, and periodically via compliance scans. Through policy effects such as Deny, Azure Policy will block the deployment of a resource that is missing a required tag, while the Append effect can automatically add the missing tag with a default value. These effects operate during the resource provisioning process, ensuring that tag naming and required tags are consistently applied across subscriptions. This direct property-level enforcement is exactly what the scenario requires.

This is a primary purpose of management groups. By placing subscriptions under a management group, you can assign Azure Policy definitions and role-based access control (RBAC) initiatives at the management group level, and those assignments are inherited by all descendant subscriptions and resources. This enables consistent governance, compliance, and access control across the entire hierarchy without needing to configure each subscription individually.

Resource Locks are the correct protection mechanism for a production resource group. They are applied at the resource group or individual resource scope and override any RBAC role, even Owner or Contributor, by blocking delete or modification operations. A CanNotDelete lock prevents deletion, while a ReadOnly lock prevents both deletion and changes to resource properties, ensuring critical production assets are safeguarded against accidental or malicious actions.

Azure Key Vault is a cloud service designed specifically to safeguard cryptographic keys, certificates, and application secrets such as connection strings and API keys. It enforces access control through Azure AD and RBAC/access policies, supports hardware security modules for key protection, and integrates with monitoring and rotation for audited, centralized secrets management.

Both the root-level and UK-level policy assignments are evaluated against resources in the UK management group; Azure Policy inheritance combines all assignments from every ancestor scope. When these policies produce different effects, Azure Policy does not use ordering but instead applies the most restrictive effect. Deny is the highest-precedence effect, so the UK's Deny policy overrides the root's less restrictive effect, blocking all resource creation. This is deterministic and designed to enforce guardrails across hierarchy levels.

ARM templates and Bicep are Azure's native declarative infrastructure-as-code formats. You define the target state of your resources, and Azure Resource Manager performs the necessary operations to achieve that state, including dependency resolution and rollback on failure. This makes deployments idempotent and repeatable, which is exactly what the question is looking for, so this is the correct answer.

Azure Monitor is the correct service because it captures and retains the Activity Log, which records control-plane events such as virtual machine deallocation. By creating an Activity Log alert rule, you can define a condition that fires when the 'Deallocate Virtual Machine' operation occurs, sending notifications via action groups to email, SMS, or webhook. This makes Azure Monitor the go-to for real-time, resource-level operational alerts.

Microsoft Defender for Cloud is the correct answer because it serves as a unified security posture management and threat protection platform, aggregating security signals from Azure, on-premises, and other clouds. It continuously assesses resources against compliance standards, provides hardening recommendations, and offers just-in-time access and adaptive application controls. This breadth of capabilities — covering vulnerability management, regulatory compliance, and workload protection — is exactly what the question describes.

Azure budgets let you set a cost or usage threshold and then configure alerts on actual or forecasted spend reaching a defined percentage of that threshold (for example, 50%, 90%, or 100%). These alerts integrate with Azure Action Groups to send email, SMS, or webhook notifications. This is exactly what the correct answer describes: establishing spending limits and being notified as you approach them.

Azure Cloud Shell is an interactive, browser-based management shell offering both Bash and PowerShell experiences with the Azure CLI, PowerShell Az modules, and common tools such as kubectl pre-installed. It automatically authenticates users through their Azure portal session, eliminating the need for a separate sign-in when managing resources. Because it runs in a temporary container that mounts an Azure Files share, it provides persistent file storage across sessions while the underlying compute is ephemeral.

The Append effect is correct because it automatically adds the specified tag (and its value) to a resource during creation or update, without blocking the operation. This is ideal for enforcing a naming convention through metadata: you can append a tag such as 'NameStandard' or append a prefix to an existing tag field, ensuring every resource carries the required identifier while still allowing the resource to be provisioned. Because it modifies the resource in-place to make it compliant, it provides a non-disruptive enforcement mechanism.

Azure AD Access Reviews are the correct feature for periodically recertifying privileged roles and group memberships. Administrators can configure recurrence, assign reviewers, and automatically remove users whose access is not affirmed, enforcing the principle of least privilege. Unlike passive audits or activation logs, Access Reviews require humans to actively certify business need, with results applied to keep identity assignments current and compliant.

Azure Blueprints allows you to define a repeatable set of Azure resources and governance artifacts (policies, role assignments, resource groups, ARM templates) that can be assigned to subscriptions. Blueprints are versioned and auditable, ideal for a single package that enforces a standard environment.

An Azure subscription serves as both the billing unit and an access boundary for all resources it contains. All usage from resources within a subscription is aggregated into a single invoice, and Azure RBAC permissions assigned at the subscription scope apply to every resource in it. This dual role makes the subscription the primary management and cost-control boundary in Azure.

Azure Blueprints enables you to deploy a standard set of cloud artifacts by packaging ARM templates, policy assignments, role assignments, and resource groups into a single, versioned definition. When assigned to a subscription, Blueprints automatically creates the resources, applies governance rules, and aligns the environment to compliance mandates like ISO 27001. It is the only service purpose-built to orchestrate this entire stack as one coherent unit.

Azure Policy with the 'DeployIfNotExists' effect automatically evaluates existing resources for compliance. When a non-compliant resource is found, a remediation task can execute a deployment to bring the resource into compliance (e.g., convert unmanaged disks to managed disks). The policy also applies to new resources, ensuring all future VMs use managed disks.

Microsoft Sentinel is a cloud-native SIEM and SOAR platform that provides intelligent security analytics and threat response across your entire enterprise. It ingests data from various sources, including Azure services, on-premises environments, and third-party products, then uses built-in analytics and user and entity behavior analytics (UEBA) to detect and investigate threats. Sentinel also includes automation playbooks that allow you to respond to incidents automatically, reducing manual effort. This combination of security information management and automated orchestration makes Sentinel the correct choice for a comprehensive security analytics platform.

Azure Service Health alerts are designed to proactively notify you about Azure platform incidents, including service outages, performance degradation, and planned maintenance, that affect the services and regions you use. You can create alerts based on service health notifications, and these alerts also integrate with Azure Monitor and action groups to ensure timely delivery via email, SMS, webhook, or ITSM. This matches the scenario exactly: receiving notifications about Azure platform issues like outages or planned maintenance. Therefore, this is the correct choice.

Azure Resource Health provides a personalized view of the current and historical health of individual Azure resources, such as a specific virtual machine or web app. It uses service health signals and resource heartbeats to detect whether a resource is available, degraded, or unavailable, and then offers troubleshooting guidance and root cause analysis. Unlike tools that show global issues, it focuses on the exact resource instance you're concerned with.

Azure Reserved VM Instances offer a significant discount (up to 72%) in exchange for a one- or three-year commitment. For a stable, predictable workload that must run continuously, this commitment aligns perfectly with the usage pattern and locks in lower costs, making it the best option among those listed.

Azure Resource Graph is a query service that lets you explore Azure resources across all your subscriptions using the Kusto Query Language (KQL). It supports complex filtering, grouping, and projection of resource properties, making it the right tool for ad-hoc inventory queries and discovering resources with specific configurations. Unlike telemetry or policy services, it is purpose-built for resource-level exploration at scale, returning a live view of the resource inventory.

Cost Management + Billing is the dedicated Azure solution for cloud financial governance. It aggregates and analyzes cost data across multiple subscriptions, resource groups, and management group scopes, providing roll-up views, budgets, and anomaly alerts. This enables precise tracking and management of spending across an entire Azure estate.

The Modify effect is designed to add, update, or remove properties of a resource to ensure compliance. It can automatically correct tag values (e.g., set 'Environment' to 'Production') even if the user provides a different value, without blocking the resource creation. This matches the requirement exactly.

DeployIfNotExists is an Azure Policy effect that automatically deploys a desired configuration to existing resources that are non-compliant, using a linked managed identity with the necessary permissions. When the policy is assigned, it evaluates existing resources and creates remediation tasks that trigger a deployment to bring them into compliance. This effect is specifically designed for automatic remediation and is the only option among these that actively fixes already provisioned storage accounts.

This is the correct definition of cloud computing. It delivers a broad set of computing resources — including servers, storage, databases, networking, software, analytics, and intelligence — over the internet, with consumption-based pricing that lets you pay only for what you use. The provider manages underlying infrastructure while customers gain on-demand scalability and rapid provisioning, which are key characteristics that distinguish cloud from traditional IT.

Management groups are Azure containers that hold subscriptions, enabling you to organize them into a hierarchy for unified governance, policy assignment, and cost management. By nesting management groups, you can apply access or policies at the top level and have them inherit down to all subscriptions and their resources, making them the correct tool for hierarchical subscription organization.

Activity Log records control plane operations; Diagnostic Logs record data plane access for audit purposes.

Microsoft Defender for Cloud's Secure Score aggregates the health of all security controls across subscriptions into a single numerical score, expressed as a percentage. Each security control contains multiple recommendations; the score reflects the percentage of healthy resources within those controls. This score directly measures and tracks your overall security posture, enabling prioritized remediation across your entire Azure estate.

In Azure, compliance is the state of adhering to binding regulatory standards, statutory laws, and internal organizational policies that govern data handling, access, and security. Azure provides certifications and attestations such as GDPR, HIPAA, ISO/IEC 27001, and FedRAMP, with services like Azure Policy and Microsoft Purview to enforce and evidence that adherence. This broad definition covers both legal obligations and enterprise governance criteria, which is why it precisely matches the meaning of compliance.

Correct. Azure Policy with the 'Deny' effect prevents the creation of resources that do not meet the policy rule. Policy exemptions allow the team to exclude specific scopes from the policy assignment, enabling exceptions for disaster recovery testing without modifying the policy definition.

Identity Protection is a Microsoft Entra ID feature that uses machine learning algorithms to detect suspicious activities such as impossible travel, anonymous IP addresses, atypical sign-ins, and leaked credentials. It assigns a risk level to sign-ins and users, and can automatically enforce policies (via Conditional Access) to require MFA, block access, or trigger a secure password change.

Management Groups create a hierarchy that sits above Azure subscriptions, allowing you to organize multiple subscriptions by business unit, environment, or department. Governance is applied at the management group level through Azure Policy and role-based access control (RBAC), and those assignments are inherited by every subscription and resource within that group. This enables consistent compliance and access control across an entire enterprise without configuring each subscription separately.

Cost allocation in Azure Cost Management lets you create distribution rules that take shared costs (such as a central ExpressRoute connection or shared support fees) and proportionally reattribute them to specific teams, projects, or business units based on tags, subscriptions, or resource groups. It reorganizes the Cost Management report so each team can see its 'fair share' of an otherwise centralized cost, which is the foundation for chargeback or showback reporting. Critically, it only changes how costs are displayed for reporting; it does not alter billing, enforce limits, or trigger any automated action.

Management groups serve as hierarchical containers in the Azure governance structure, explicitly designed to hold one or more subscriptions. They provide a top-down scope for assigning Azure Policy and Role-Based Access Control (RBAC) that automatically propagates to every child subscription, making them the correct choice when each department has its own subscription that must be managed under a common governance umbrella. Management groups also support multiple levels of hierarchy, allowing organizations to reflect departmental structures while maintaining centralized control over compliance and access.

The All Resources blade in the Azure portal provides a centralized list of every resource across all subscriptions and resource groups to which the user has read access, with filtering, grouping, and column customization. It is the correct answer because it is specifically designed to give an inventory of all deployed resources, whereas the other options serve different purposes. It allows you to search, filter by subscription/resource group/type/location, and manage resource properties from a single unified view.

Azure Blueprints is a native Azure governance service that packages ARM templates, RBAC role assignments, and Policy assignments (including initiatives) into a single, versioned definition. When you publish and assign a blueprint, Azure creates an auditable relationship that tracks exactly which blueprint version was deployed to which subscription, along with the resulting resources, roles, and policies. This built-in assignment tracking and versioning distinguish Blueprints from standalone tools and make it the correct choice when you need a repeatable, governance-bundled environment with a clear audit trail.

Management groups support hierarchical organization of Azure subscriptions, enabling centralized governance, policy assignment, and access control across a global enterprise. They can nest subscriptions under a common structure, allowing consistent RBAC and compliance at scale. This makes them the appropriate mechanism for organizing resources by business unit, region, or other top-level groupings.

Azure Policy definitions are the correct mechanism because they are explicit rules that evaluate resource properties during and after deployment. A policy definition includes a condition (for example, 'VM SKU is one of the allowed values') and an effect such as Deny, Audit, or Modify, and it can be assigned to a management group, subscription, or resource group to enforce required configurations. When a user attempts to create a VM with a size not in the allowed list, the policy blocks the deployment, which is exactly the scenario described in the question.

Azure Budgets in Microsoft Cost Management supports multiple spending thresholds—both absolute amounts and percentages of budget—and each threshold can be associated with an action group that sends email alerts, invokes Azure Functions, or triggers an Automation runbook. This enables both proactive monitoring of spend and automated control actions when a threshold is reached, fully satisfying the requirements for monitoring and controlling Azure spending.

Azure Policy can enforce rules like allowed resource locations across a subscription or resource group.

Management groups are the correct answer because they are Azure's enterprise-grade construct for organizing subscriptions into a hierarchy. A management group can contain one or more subscriptions, and management groups themselves can be nested up to six levels deep. This hierarchy enables you to apply Azure Policy and role-based access control (RBAC) at a parent scope, and all child subscriptions and management groups automatically inherit those assignments. Management groups are the only option in this list that explicitly forms a subscription-level hierarchy for policy and billing governance.

Azure Application Insights is the application performance management (APM) service within Azure Monitor, purpose-built for live web applications. It automatically collects request rates, response times, failure counts, dependency calls, page views, and custom events, and uses built-in anomaly detection to alert on deviations. This directly matches the question's requirement to monitor a live web app's performance and user behavior with automatic anomaly detection.

Assigning the Reader role grants the user read-only visibility to all resources in the scope, which satisfies the 'see' aspect of the requirement. Then, adding a custom RBAC role that contains only the Microsoft.Compute/virtualMachines/restart/action permission narrowly grants just the restart action without exposing any other management operations. Combining these two assignments delivers exactly the requested capability—viewing virtual machines and restarting them—while strictly adhering to the principle of least privilege.

Azure Cost Management + Billing is the dedicated service for tracking cloud spend, aggregating usage data from all subscriptions and presenting it in cost analysis views. It supports grouping by tags such as department or project, creating budgets, setting alerts, and even applying cost allocation rules to distribute shared services. Because it directly ingests billing data and provides filtering, charting, and drill-down, it is the correct way to trace resource usage to departments and projects.

Azure Resource Graph is a query service that uses Kusto Query Language (KQL) to explore and discover Azure resources across subscriptions and management groups. It enables a security team to build a single cross-subscription query that returns VM inventory, metadata, and configuration details like public IP assignments or OS settings. This makes it purpose-built for the audit task described, as it federates resource metadata without requiring per-resource API calls or telemetry collection.

Azure Monitor is Azure's unified telemetry and observability service. For virtual machines, it captures platform-level metrics (CPU, disk, network) via the Azure platform, and can additionally collect guest OS performance counters through the Log Analytics agent. Alerts can be defined using metric thresholds (e.g., CPU > 90% for 5 minutes) or log queries, making it the correct service for performance monitoring and alerting.

Correct: A remediation task automatically scans existing resources and applies the 'DeployIfNotExists' effect to bring them into compliance. This is the intended mechanism for remediating non-compliant resources that existed before the policy was assigned.

Assigning two policies, one with Deny and one with Audit, simultaneously blocks forbidden VM SKU creation and provides a clear compliance view of all attempts (both successful and blocked) for auditing. This is the minimum configuration to satisfy both requirements.

The audit effect evaluates resources against the policy definition and, when a resource doesn't meet the conditions, marks it as non-compliant in the Azure Policy compliance dashboard. Critically, it neither blocks the resource's creation nor changes its configuration; the resource remains operational and fully deployed. This makes audit ideal for measuring compliance posture and detecting drift without impacting existing or newly deployed workloads.