CCNA Describe Azure management and governance Questions

An Azure Policy exemption is the designated mechanism to exclude a specific scope, such as the Sandbox subscription, from evaluation by an existing policy assignment. It allows the team to avoid compliance reporting for that subscription without modifying or deleting the policy assignment itself. Exemptions can be time-bound and require a justification, and the excluded scope is reported as 'exempt' in compliance results rather than 'non-compliant'.

Correct. Azure Policy allows you to create, assign, and manage policies that enforce different rules over your resources. The 'Allowed Locations' policy definition can be assigned at a management group scope to block creation of resources in regions other than West Europe, and this applies to all subscriptions under that scope.

Correct. A policy exemption allows you to exclude a scope from an existing policy assignment. The 'Waiver' category is appropriate for a planned, temporary exemption where the scope is not expected to comply, such as a development sandbox.

Assigning the policy at the root management group scope applies it to all child management groups and all subscriptions within them, including any new subscriptions created in the future. This is the correct approach for a single assignment that covers the entire organization.

Azure Policy with the 'require a tag' initiative and a deny effect actively evaluates every resource creation or update request through the Azure Resource Manager control plane before the resource is provisioned. If the resource does not include the required Owner tag, the policy blocks the operation and returns a policy violation message, ensuring that no non-compliant resource can exist. This enforcement is independent of the client used (portal, CLI, ARM template, Terraform), and it is the correct mechanism because it enforces tagging requirements at the organization's governance layer.

Azure Automation State Configuration is the correct service because it uses PowerShell DSC (Desired State Configuration) to continuously enforce an exact OS-level configuration on both Windows and Linux VMs. It defines how a machine should be configured (e.g., registry keys, installed roles, file contents) and automatically corrects any drift by reconciling the actual state with the desired state, making it ideal for ongoing operating system configuration management.

Azure Blueprints is the correct service because it orchestrates the deployment of ARM templates, role assignments, and policy assignments together as a single, coherent artifact. A blueprint definition is versioned and can be assigned to multiple subscriptions, and each assignment generates a record in the assignment history for auditing and tracking. Blueprints also support locking of resources to prevent unauthorized modifications, which directly addresses the need for a repeatable, auditable standard environment. This native governance capability is exactly what ARM templates alone or other management tools lack.

Azure Blueprints enables you to define a repeatable set of Azure resources (including policies, roles, and ARM templates) that implement and adhere to your organization's standards. Blueprints are versioned and can be assigned to management groups to automatically provision the environment in all child subscriptions.

Azure Service Health provides personalized alerts and the Service Health portal, which includes post-incident Root Cause Analysis (RCA) reports and incident timelines for actual Azure platform outages. These reports detail what happened, when, the impacted regions/services, and the corrective actions taken, making them the correct source for assessing operational impact of an Azure disruption. It surfaces both active issues and completed advisory/incident reports, so after resolution you can review the RCA.

Azure Service Health is a personalized view of the Azure platform's overall health, tailored to the specific subscriptions, regions, and resources you use. It aggregates global service issues, planned maintenance, and health advisories into a dashboard and can proactively notify you via Service Health alerts routed through Azure Monitor action groups. Unlike the public status page, Service Health filters events to those that actually affect your environment, enabling faster incident response and impact assessment.

Creating a custom role is the correct solution because built-in roles cannot provide only the restart action without additional permissions. Custom roles allow precise definition of allowed actions, adhering to least privilege. The support engineers get exactly the permission needed and nothing more.

Azure DDoS Protection Standard (also known as DDoS Network Protection) provides enhanced, always-on, adaptive mitigation for resources in a virtual network, including VMs, load balancers, and application gateways. It continuously monitors traffic to detect volumetric, protocol, and resource-layer attacks, automatically applying mitigation policies without requiring manual intervention. The service integrates with Azure Monitor, offers real-time telemetry, and generates mitigation reports, giving security teams visibility and response capabilities. It goes beyond Azure's basic infrastructure-level DDoS protections, which only address large-scale attacks that affect the platform broadly.

Azure Advisor is the correct service. It analyzes deployed Azure resources and provides personalized, prioritized recommendations across five categories: Reliability, Security, Performance, Operational Excellence, and Cost. The administrator can see the potential impact of each recommendation before implementing it.

The Modify effect in Azure Policy is explicitly designed to add, change, or remove properties (such as tags) on resources during creation and through remediation tasks. It uses a managed identity to append or update the tag value automatically, so every VM gets the correct tag without any manual intervention. Because it corrects the tag rather than blocking the VM creation, it directly meets the governance requirement to automatically set the tag to the right value.

Deny is the only Azure Policy effect that actively blocks deployment at evaluation time. During a PUT/PATCH request, Azure Resource Manager evaluates the applicable policy and, if the resource lacks the required costcenter tag, returns a 403 (Forbidden) response and the resource is never created. This makes Deny a preventive control that guarantees non-compliant resources cannot exist.

Azure Advisor is the correct service. It provides best practice recommendations across five categories: Reliability, Security, Performance, Operational Excellence, and Cost. Security recommendations include enabling Microsoft Defender for Cloud, enabling encryption, and ensuring proper security settings.

Resource Locks are applied to a subscription, resource group, or individual resource and can be set to CanNotDelete or ReadOnly, which block deletion and modification actions at the Azure Resource Manager layer. Critically, a lock is evaluated after RBAC authorization, so even a user with the Owner role cannot delete or modify a locked resource unless they first remove the lock (which requires Microsoft.Authorization/locks/write permission). This explicit lock check is what allows Resource Locks to override RBAC permissions for those protected operations, providing a safety net against accidental or unauthorized changes. Therefore, when a resource must be safeguarded from deletion, the correct mechanism is the Resource Lock.

Azure Advisor is the Azure service explicitly designed to provide personalized, actionable recommendations across all five pillars of the Well-Architected Framework: cost, security, reliability, performance, and operational excellence. It continuously analyzes your deployed resources, usage patterns, and configurations to generate proactive, prioritized recommendations with specific remediation steps. Because this matches every category listed in the question, Azure Advisor is the correct answer.

The Deny effect is the correct choice because it actively prevents the resource provider from executing the create or update operation when the policy condition is not satisfied. In Azure Policy, Deny returns a 403 Forbidden response during deployment, causing the VM creation to fail immediately and ensuring that only approved SKU sizes can ever be provisioned. This effect is evaluated during the authorization phase of the deployment, before any resource is instantiated, making it the only option listed that truly blocks a non-compliant VM.

Azure Policy is the correct service because it defines business rules as policy definitions that apply to resource types and properties, using effects such as Deny, Audit, Modify, Append, and DeployIfNotExists to govern resource configurations. Policies are assigned to scopes ranging from a management group to an entire subscription or resource group, and the service continuously scans all existing resources for compliance, marking them compliant or non-compliant. This exactly matches the requirement to enforce organizational rules and assess compliance across resources at scale rather than manage identities or provide recommendations.

Azure Blueprints allows you to define a repeatable set of Azure resources, policies, and role assignments that implement and adhere to an organization's standards, patterns, and requirements. A blueprint can be assigned to a subscription to create a consistent environment.

Azure Cost Management + Billing is the native Azure service for monitoring and analyzing cloud spending. Its cost analysis area allows you to group and filter costs by tags, such as project codes, enabling you to track exactly how much each project incurs. It also provides built-in reports that surface untagged resources, helping you enforce tagging discipline for accurate cost allocation. Therefore, it is the correct tool for the finance team's requirement to track costs by project.

This option precisely defines the Reliability pillar of the Azure Well-Architected Framework, which emphasizes building workloads that can recover from component, regional, or application failures and continue to operate within agreed availability SLAs. Implementing reliability requires redundancy across availability zones/regions, automated failover, robust backup and restore processes, and capacity planning to absorb spikes. By directly addressing failure recovery and availability requirements, it captures the core objective of the Reliability pillar.

The built-in Azure Policy definition 'Allowed virtual machine size SKUs' is designed to evaluate the sku.name property of the Microsoft.Compute/virtualMachines resource type. When assigned with the Deny effect at a management group, subscription, or resource group scope, the policy blocks any VM creation or update that uses a SKU not listed in the allowed array. This provides a hard enforcement mechanism at deployment time, ensuring that only pre-approved VM sizes are used, and it is precisely the correct service for restricting VM sizes by configuration, not by identity.

Azure Policy is the correct choice because it can be assigned at management group or subscription scope to enforce resource rules—such as allowed VM SKUs or required tags—across all department subscriptions. Policy definitions use effects like Deny, Audit, or Append, and every existing or newly created resource is continuously evaluated for compliance. A built-in compliance dashboard reports which resources are compliant or non-compliant, giving the centralized governance and reporting the departments require.

Tags are metadata name-value pairs for organizing, tracking costs, and filtering Azure resources.

The creation will succeed because the Sales-Dev subscription is explicitly excluded from the policy assignment. In Azure Policy, an assignment at a management group scope applies to all child subscriptions by default, but the assignment's exclusion list can remove specific subscriptions, resource groups, or resources from evaluation. Because the Sales-Dev subscription is listed as an exclusion, the Deny effect of the policy never evaluates resources there, so the virtual machine creation is allowed.

A resource group is a logical container for holding related Azure resources, such as virtual machines, app services, and databases, so that you can manage them as a single unit. Resource groups enable granular role-based access control, cost aggregation, and the ability to apply policies or locks to all contained resources. Every Azure resource must belong to exactly one resource group, making it the correct answer for organizing resources.

Azure Arc enables you to project non-Azure (on-premises, multi-cloud) resources into Azure Resource Manager, allowing you to manage them with Azure tools like Azure Policy and Azure Monitor. This directly meets the requirement to manage on-premises servers without migration.

Deny is a proactive policy effect that prevents the resource from being created or updated if it violates the policy condition. For storage accounts, any request to create a Premium performance tier fails immediately with an authorization error, and the resource provider never provisions the account. This ensures the 'standard performance' requirement is enforced at deployment time, not just reported after the fact.

Microsoft Service Trust Portal is the official site where Microsoft publishes its compliance documentation, including audit reports, certifications, and data protection resources for Azure and other cloud services. It allows customers to review independent assessments such as SOC reports, ISO certificates, and FedRAMP system security plans. This is exactly what a customer needs to meet their own compliance obligations while using Microsoft's cloud, making it the correct answer.

Resource Locks prevent accidental deletion or modification by overriding user permissions for those specific operations.

Azure Policy's 'Append' effect is a non-blocking governance action that injects specified fields, such as the 'Department' tag, into a resource as part of the resource manager's evaluation during create or update operations. If the tag is missing, Append adds it automatically before submission, ensuring the resource remains compliant without throwing an error. Because Append does not reject the deployment, it precisely matches the requirement to automatically apply the tag rather than prevent resource creation.

A read-only lock on the storage account prevents any user, including those with Owner or Contributor roles, from deleting or modifying the resource. It still allows read operations, such as reading the backup data. This lock is the correct Azure governance feature to make a resource immutable and protect it from accidental or intentional deletion or changes.

DeployIfNotExists is the correct effect because it automatically deploys a diagnostic setting to any Azure Storage account that is missing one during policy evaluation. When the policy assignment's managed identity has the necessary Azure RBAC permissions (e.g., Storage Account Contributor or Monitor Contributor), it creates the diagnostic setting without blocking the storage account's creation. This effect also supports remediation tasks to fix existing non-compliant accounts, ensuring the policy requirement is enforced continuously.

Creating a custom role with only the required actions—Microsoft.Compute/virtualMachines/start/action, /restart/action, and /deallocate/action—is the least-privilege solution. This role can be scoped to a resource group or subscription and assigned to the specific group, granting exactly the operational control needed without allowing resource creation, deletion, or other management tasks.

Azure Resource Locks (CanNotDelete or ReadOnly) prevent accidental deletion or modification of resources. Even users with Owner permissions must remove the lock before they can delete the resource, ensuring a two-step process. This meets the stated requirement exactly.

The principle of least privilege restricts user, application, or service principal access to only the minimum permissions required to perform assigned job functions. By granting granular permissions at the appropriate scope, Azure reduces the attack surface and limits the potential blast radius if a credential is compromised. This principle directly governs how RBAC role assignments are sized, ensuring no identity receives standing access beyond its operational need.

The Modify effect uses a defined role (via managed identity) to change resource properties on existing and new resources. It can automatically add the 'CostCenter' tag with a default value to both existing VMs (through remediation tasks that run automatically or on a schedule) and new VMs, fulfilling the requirement without blocking resource creation.

Azure Cloud Shell is a browser-based, interactive shell that is automatically authenticated to your Azure subscription, with Azure CLI and PowerShell pre-installed. It runs in a temporary container but persists user files in an attached Azure Files share, making it a convenient environment for managing resources from anywhere. Because it meets the exact requirement of a browser-based, authenticated command-line interface for Azure, this is the correct answer.

The Azure portal is the primary web GUI for managing all Azure services at portal.azure.com.

This is correct because an exemption allows resources to be evaluated by the policy but marks them as exempt. You can provide a rationale, set an expiration date, and categorize the exemption (e.g., 'Mitigated' or 'Waiver'). The policy remains enforced for all other resources, and the exemption is visible in compliance reports for auditing.

The Azure Activity Log is turned on automatically and records all subscription-level management events, including operations such as creating, modifying, or deleting resources. Each entry contains crucial audit details: the resource ID, the operation name, the event initiator, the timestamp, and the final status of the operation. This rich, queryable log is precisely what is needed to answer questions about 'who, what, when, and where' for management activities.

Azure tags are key-value metadata pairs that can be applied directly to resources, resource groups, and subscriptions, enabling flexible, cross-cutting categorization. In Cost Management, you can group and filter costs by tag keys such as 'Project' or 'Team', which makes tags the ideal mechanism for allocating costs across multiple projects without reorganizing your subscription hierarchy. However, tags are not inherited by default, so ensure they are applied consistently at the resource or resource-group level to achieve accurate reporting.

Azure Policy can be assigned at a management group or subscription level to audit and automatically enforce compliance rules. It includes built-in policies for storage encryption with customer-managed keys and can perform automatic remediation. This is the correct choice because it allows centralized governance across multiple subscriptions.

Cost Management + Billing is the dedicated Azure service for visualizing and controlling cloud spend across subscriptions. It offers cost analysis, budgets with alerts, and recommendations from Azure Advisor to optimize resource usage, such as resizing underutilized VMs or purchasing reserved instances. It also supports chargeback by cost center or tag.

Azure Resource Graph is the correct answer because it is a purpose-built service for efficiently querying resource metadata across multiple subscriptions. You write a Kusto Query Language (KQL) query to filter and project properties like VM name, resource group, and location, and Resource Graph uses its indexed store to return results from all 50 subscriptions in one call. Unlike the ARM API, it does not require custom pagination or looping, and it returns only the specific fields you request, making it ideal for ad-hoc discovery and inventory scenarios.

Azure Service Health provides a personalized view of the health of Azure services in the specific subscriptions and regions you use. It delivers proactive alerts about service issues, planned maintenance, and health advisories, along with a dashboard for tracking ongoing incidents and historical root causes. These alerts can be customized through action groups to notify relevant teams via email, SMS, or webhooks, making this the correct answer.

Azure Resource Graph (ARG) is the correct choice because it is a query service specifically built for resource discovery and inventory across subscriptions and management groups. It uses Kusto Query Language (KQL) to return a consolidated snapshot of all defined resources, including their metadata, tags, and effective policies, at near-real-time speed. ARG indexes resource data from Resource Manager so you can cross-reference properties and build large-scale correlated queries that a simple list API cannot efficiently provide.

Azure RBAC is an authorization system built on Azure Resource Manager that grants access to users, groups, service principals, and managed identities via role assignments. A role assignment binds a role definition (e.g., Reader, Contributor, Owner) to a security principal at a specific scope: management group, subscription, resource group, or individual resource. This enables fine-grained permission control following the principle of least privilege, without sharing account credentials or writing custom authentication logic.

A Policy Initiative (also called a policy set) in Azure Policy is the correct way to enforce a consistent set of security policies across resources and subscriptions. It groups multiple individual policy definitions into a single assignable unit, allowing you to apply an overarching compliance goal—such as 'Enable Monitoring in Azure Security Center'—to a management group, subscription, or resource group as one entity. This is exactly the intended mechanism for bundling related policies, and when assigned, all included policy definitions are evaluated and enforced together.

Assigning an Azure Policy at a management group scope automatically propagates that policy down to every underlying subscription, including subscriptions that are added to the management group after the assignment is made. This inheritance is transitive and immediate, so all current and future subscriptions in the hierarchy are governed consistently from the moment they join. By using management groups, an organization can enforce baseline policies across the entire environment without needing to configure each subscription individually, which makes this the correct answer.

DeployIfNotExists is a policy effect that evaluates an existing resource and, if non-compliant, deploys a supplemental resource from a linked template — for example, a storage encryption extension or a customer-managed key configuration. This effect creates new resources (not just edits properties) and is the correct way to automatically enforce encryption on storage accounts. It requires a managed identity and role assignments for the deployment, and it can also be run as a remediation task against existing resources.

Azure Resource Graph is a service that allows you to query Azure resources across all subscriptions using Kusto Query Language (KQL). It is designed for inventory, governance, and compliance scenarios, enabling you to retrieve information like VM power state, OS, and size efficiently from multiple subscriptions.

Azure Cost Management + Billing is the dedicated service for monitoring, analyzing, and allocating expenditure across Azure subscriptions. It provides cost analysis views, budgets, and alerts, and supports cost allocation rules that let you assign shared costs to different departments based on tags or formulas. This directly meets the requirement to track and distribute costs across multiple subscriptions for chargeback or showback.

Azure Arc allows you to manage servers and Kubernetes clusters outside of Azure as if they were Azure resources. You can apply Azure Policy, Azure Monitor, and RBAC to these resources, providing unified governance and inventory across on-premises and multiple clouds.

Correct. An Azure Policy initiative (policy set definition) groups related individual policy definitions into a single unit that can be assigned at scale. This allows the organization to enforce all compliance requirements together consistently across subscriptions.

Correct. Azure Blueprints allows declarative definition and orchestration of resources, policies, and roles for creating compliant environments.

Upgrading the blueprint assignment is the correct action because an existing subscription's assignment is bound to the specific published version it was created with. When you publish a new version, it does not affect existing assignments. An upgrade updates that assignment to the latest version, causing Azure Blueprints to reapply the blueprint's artifacts (policies, role assignments, resource groups, ARM templates) to align the subscription with the new standard.

Azure Cost Management + Budgets is the dedicated service for tracking, analyzing, and controlling Azure spending. You can create budgets at the subscription or resource group scope, set thresholds, and configure alerts based on either actual or forecasted costs; notifications are sent via email and can also trigger action groups. It also provides cost analysis views for identifying spend trends and anomalies, making it the correct choice for budget alerting.

Azure Blueprints is the only service that creates a single, versioned, orchestrated package containing Azure Policy assignments, RBAC role assignments, and resource groups. It can be assigned directly to a new subscription at creation time, so the blueprint's governance artifacts are deployed together in a consistent, repeatable way. Blueprints also support versioning, locking, and lifecycle control, making them the correct mechanism for ensuring new subscriptions start with the required governance baseline.

Azure Blueprints is a governance service that packages cloud-ready environment artifacts — ARM templates, Azure Policy definitions, RBAC role assignments, and resource groups — into a single versionable blueprint definition. When assigned to a subscription, the service orchestrates the deployment of all artifacts together, enforcing policy and role assignments as part of the resource creation process. This makes it explicitly suited for standardizing a set of compliant environments, unlike ARM templates alone or management groups.

The Append effect automatically adds the missing 'Owner' tag to a resource as part of the Azure Resource Manager request during creation or update. It modifies the incoming request before the resource is provisioned, ensuring the tag exists without blocking the operation. This makes it the exact tool for enforcing a 'must have an owner tag' policy from the start.

ARM templates are declarative JSON files that define the desired state of an Azure environment, including virtual networks, subnets, and other resources. Because they are idempotent, you can deploy the same template repeatedly to different resource groups to create a consistent set of resources, and redeploy it to apply updates. They also integrate with version control and can be parameterized to customize names, regions, or settings across environments.

The Azure portal is a web-based graphical interface that provides a unified console for managing all Azure services and resources. Accessible through any modern browser, it enables users to create, configure, monitor, and troubleshoot resources using dashboards, menus, and forms. It is the primary graphical user interface for interacting with Azure, backed by Azure Resource Manager for consistent management and governance.

Microsoft Defender for SQL is the correct choice because it delivers a full security workload protection suite for Azure SQL databases. It includes vulnerability assessments that scan for misconfigurations, threat detection that alerts on anomalous and malicious database activity, and security recommendations surfaced through Microsoft Defender for Cloud. These capabilities directly address the need for security posture evaluation and threat response, which is the core focus of this question. Other services such as monitoring, key management, and auditing only cover a narrow slice of what Defender for SQL provides.

Azure Advisor cost recommendations are the correct answer because Advisor continuously analyzes the configuration and usage telemetry of your already-deployed Azure resources. It identifies underutilized virtual machines (by CPU and network utilization), orphaned resources, idle load balancers, and opportunities to purchase reserved capacity or resize instances, then presents the estimated monthly savings. These recommendations are actionable, prioritized, and provided directly in the portal with a projected cost impact.

Azure Cost Management + Billing is the native solution for monitoring and analyzing Azure expenditure across subscriptions and management groups. It provides a unified cost view with features such as cost analysis, budgets, alerts, and recommendations, plus integration with billing data for actual and amortized costs. You can break down costs by resource, resource group, or tag, and even view forecasted spend. This fully satisfies the requirement for comprehensive cross-subscription cost analytics.

Azure Monitor Alerts is the correct service because it systematically evaluates resource metrics (such as CPU usage, memory, or custom app metrics) against defined threshold conditions on a set schedule. When the condition is true, it activates an action group that sends notifications or runs automation. This provides proactive, real-time alerting for performance and health of your individual Azure resources. It directly matches the requirement to notify when a resource metric crosses a threshold.

Azure Blueprints enables the orchestrated deployment of a complete environment, including policies, RBAC assignments, resource groups, and even ARM templates. Blueprints are versioned and support automatic updates to existing assignments, making them ideal for landing zone deployments.

A ReadOnly Resource Lock is the correct and definitive mechanism to prevent resource moves. When applied to a resource group or resource, it blocks all write operations, including the action of moving that resource to another resource group. Because the move operation conceptually changes the parent resource group, it is treated as a write and is denied even for users with Owner or Contributor permissions. This is precisely the role-independent, blanket protection the question requires.

Azure CLI is a dedicated, cross-platform command-line tool distributed as an installable package that issues `az` commands to manage Azure resources. Unlike Cloud Shell, it runs locally on Windows, macOS, or Linux, and its commands authenticate via Microsoft Entra ID before calling the Azure Resource Manager REST API. Because the question asks for a specific CLI product with cross-platform support, Azure CLI is the correct answer.

Microsoft Defender for Cloud includes a dedicated regulatory compliance dashboard that aggregates security findings and policy evaluations across all subscriptions against a wide range of built-in standards, such as CIS, NIST, Azure Security Benchmark, and ISO 27001. This dashboard gives a unified percentage-based posture, provides per-standard drill-downs, and supports adding custom initiatives to align with specific regulatory requirements. It is the correct Azure service for viewing consolidated multi-standard regulatory compliance at scale.

A Delete lock prevents the resource from being deleted but allows all other operations, including reading and updating data. This directly satisfies the administrator's need to protect against accidental deletion while still permitting data modifications.