CCNA Describe Azure management and governance Questions

Azure Marketplace is an online catalog where customers can browse, purchase, and deploy third-party software and solutions that have been certified to run on Azure. It includes offerings such as virtual machine images, containers, SaaS applications, and API services from independent software vendors. These solutions can be deployed directly through the Azure portal, using Azure Resource Manager for lifecycle management, and are billed through the customer's Azure subscription. This makes it a one-stop shop for extending Azure with validated third-party capabilities.

Azure Resource Graph is the correct choice because it is a native Azure service that uses Kusto Query Language (KQL) to query resource metadata—including tags, SKUs, and creation timestamps—across all subscriptions in a tenant without needing to iterate per subscription. Its 'where' clauses allow exact filtering for the presence of an 'environment' tag, and it returns results quickly even at scale. Unlike PowerShell or CLI, it is purpose-built for cross-subscription, tenant-wide resource discovery and also integrates with Azure Policy and change tracking.

Azure Service Health is the correct service for receiving notifications about the availability of Azure services in the regions you use. It provides a personalized dashboard and can send proactive alerts on service issues, planned maintenance, and health advisories that affect your subscriptions and resources. Unlike other monitoring tools, it is specifically designed to communicate platform-wide health events from Azure itself, not from your own applications.

Custom RBAC role definitions are correct because Azure RBAC supports building your own roles when built-in roles lack the required granularity. A custom role is a JSON definition that specifies a list of allowed actions (and optionally NotActions) plus assignable scopes, and once it is assigned at a scope, it directly grants or denies access to Azure resource management operations. This is the only mechanism listed that actually defines a set of Azure resource permissions, which is precisely what the question asks for.

Multiple subscriptions provide the only correct billing boundary among these options because each Azure subscription is a distinct billing entity linked to an enrollment or billing profile. Each subscription generates its own invoice or cost statement and can have its own payment method, budget, and Azure RBAC scope. This allows a department to own its subscription, see its specific usage charges, and control access independently, making multiple subscriptions the right mechanism for separating costs and permissions.

Enterprise Support is the only Azure support plan that guarantees a 15-minute initial response for Severity A incidents and assigns a dedicated Technical Account Manager (TAM) to the customer. This direct match to the stated requirements makes it the correct choice, as the dedicated TAM provides proactive architectural guidance and faster, more personalized support.

Azure Policy and RBAC assignments are inherited down the management group hierarchy: a policy or role assignment placed on a management group automatically applies to all child subscriptions and resource groups, and to every resource within those scopes. This ensures that governance rules and access permissions are consistently enforced across an entire enterprise hierarchy, eliminating the need to configure each scope individually. Inherited assignments can be overridden or complemented by assignments at more specific scopes.

The DeployIfNotExists effect automatically deploys a resource (in this case, an NSG and its association to the subnet) when a VNet is created without it. This ensures compliance without manual effort from developers, matching the requirement exactly.

Basic support is the free tier included with every Azure subscription. It provides access to documentation, whitepapers, community support forums, and the Azure Service Health dashboard for real-time status updates, but it does not include any direct, ticket-based assistance from Microsoft support engineers. Because the question asks for the free plan, Basic support is the correct answer.

Azure Policy is a service that allows you to create, assign, and manage policies that enforce rules and effects on resources. Specifically, a policy definition with the 'Deny' effect can prevent the creation of any resource that does not include the required costcenter tag. When a policy is assigned at a management group, subscription, or resource group scope, Azure Resource Manager evaluates the resource properties during creation and rejects non-compliant resources before they are deployed. This provides a centralized, automated enforcement mechanism that goes beyond simple tagging or manual checks.

Correct. Azure Policy includes built-in effects (e.g., modify, append) that can automatically apply or inherit tags. The 'Inherit a tag from the resource group if missing' effect copies the resource group's tag value to resources that do not already have that tag, ensuring automatic compliance.

The Azure Pricing Calculator is an interactive pre-deployment tool that lets you select specific Azure services, configure details such as region, tier, instance size, and expected usage, then calculates the estimated monthly cost. It provides a detailed cost breakdown per service, supports saving and sharing estimates, and can incorporate Azure Hybrid Benefit or reserved capacity to refine budget forecasts. This directly satisfies the requirement to estimate monthly costs for a planned Azure service before any deployment, making it the correct choice.

Azure Cost Management + Billing is the native tool for tracking, analyzing, and reporting Azure spending. It supports grouping by resource tags, which lets an organization allocate costs to specific departments, projects, or owners. It also offers budgets, cost anomaly alerts, scheduled exports, and integration with Power BI for deeper financial analysis.

Azure Cost Management is the native cloud financial management service for tracking, analyzing, and optimizing spend across Azure subscriptions. It provides a centralized view of costs, supports budget creation with alert thresholds, and includes cost analysis tools to identify spending trends and anomalies. As the umbrella service, it is the correct answer for tracking and optimizing costs.

Azure Cost Management + Billing is the native solution for analyzing and reporting Azure spending. It supports cost analysis by management group, subscription, resource group, and service, and can group costs by department through custom tags or tag inheritance. Reports include both tagged and untagged resources, ensuring complete departmental cost visibility across multiple subscriptions.

Azure Blueprints is the correct answer because it orchestrates the deployment of a complete, versioned environment that bundles resource groups, Azure Policy assignments, RBAC role assignments, and ARM templates into a single, repeatable artifact. This native service enables cloud architects to define and re-deploy a standardized governance and resource architecture across multiple subscriptions, ensuring consistency and auditability. Unlike a raw template, Blueprints maintains a versioned relationship between the blueprint definition and assigned resources, making it the only option that specifically packages all governance components together.

The Audit effect logs a compliance event in the activity log and marks the resource as non-compliant, but does not block deployment. This allows the team to generate a compliance report without interfering with existing deployments.

Azure Blueprints enables the orchestrated deployment of a collection of Azure artifacts (policies, role assignments, ARM templates, resource groups) in a versioned, repeatable manner. It is the correct service for defining and applying a consistent governance baseline across subscriptions.

Management groups are hierarchical containers that can hold subscriptions, enabling policy assignment at a group level. When you assign a policy set (initiative) to a management group, every subscription inside that group—including future subscriptions added later—inherits the policy via Azure Policy's built-in inheritance model. This centralizes compliance enforcement per business unit and eliminates the need to configure policies individually on each subscription, drastically reducing administrative overhead.

Azure Cost Management allows you to create budgets with a defined amount (e.g., $10,000) and set alert thresholds (e.g., 80% and 100%). Alerts can automatically send email notifications to specified recipients. Budgets can be scoped to resource groups, making them suitable for per-project tracking.

Azure Reservations is the correct answer because you prepay or commit to a 1- or 3-year term for virtual machines, SQL Database, Cosmos DB, or other eligible services and receive a substantial discount—up to 72% compared with pay-as-you-go pricing. The discount is automatically applied to matching resource usage, and you can choose full prepayment or monthly billing for the committed term. This commitment-based model is ideal for consistent, production workloads where price predictability and financial planning are required.

Deny is the only Azure Policy effect that blocks the resource provider request before deployment. When a resource is submitted without the costcenter tag, the policy engine evaluates the request and returns an error (e.g., 403 or 409), so the resource creation fails entirely. This guarantees that every successfully created resource already carries the tag, making it the correct choice for a mandatory tagging requirement.

The Deny effect in Azure Policy actively blocks the creation of a virtual machine when the policy condition is met. During deployment evaluation, the policy engine intercepts the request and returns an error to the user, and you can include a custom error message directing them to the approval workflow. This is the only effect among these that prevents the operation from occurring.

Role assignments at the management group scope are inherited by all subscriptions within that management group. This single assignment covers all current subscriptions and automatically applies to any new subscriptions added under the 'Production' management group, making it the most efficient method.

The Azure portal is a browser-based graphical user interface (GUI) that lets you click through blades, panes, and settings to create and manage Azure resources. The Azure CLI is a cross-platform command-line tool that returns plain text (or JSON) results and is designed for scripting, automation, and repeatable deployments. Both ultimately send REST calls to the Azure Resource Manager, but the portal emphasizes interactive control while the CLI emphasizes programmatic control. This is the accurate distinction in the answer.

Right-sizing is a cost optimization practice that uses Azure Advisor and Azure Monitor metrics to identify virtual machines, SQL databases, or App Service plans that are consistently underutilized (e.g., low CPU, memory, or I/O). By resizing these resources to a smaller, appropriately matched SKU or tier, you eliminate waste from overprovisioning while maintaining performance. It directly aligns with the Well-Architected Framework's cost optimization pillar, and unlike other options, it does not involve pre-purchase commitments or altering data replication or disk types.

Azure Blob Storage lifecycle management policies are native rules defined on a storage account that automatically transition blobs from Hot to Cool and from Cool to Archive, or delete expired blobs and snapshots, based on conditions such as last modified time or last access time. They can be scoped to prefixes, blob index tags, or specific blob types to enable granular control. This is the correct solution because it directly implements automated data movement across tiers with no manual intervention, which is exactly what the scenario requires.

Azure Blueprints allows you to define a repeatable set of Azure resources, policies, role assignments, and more. Blueprints can be deployed to multiple subscriptions, and when the blueprint definition is updated, existing assignments can be upgraded to apply the changes automatically. This meets all the requirements: consistent deployment, central updates, and automatic propagation.

An Azure Policy initiative (policy set definition) is designed specifically to group multiple policy definitions into a single, assignable unit. Assigning the initiative to the appropriate management group or subscription applies all included policies at once, simplifying management and enabling consolidated compliance reporting.

Creating an exclusion on the policy assignment is the correct approach because Azure Policy allows you to specify child scopes (such as a single subscription) that should be exempt from the policy's evaluation, while the assignment still applies to all other subscriptions in the management group. Exclusions are defined directly on the assignment, so the policy definition remains unchanged and governance for the rest of the hierarchy stays intact. This is the intended mechanism for carving out a scope from an inherited policy without losing oversight.

PIM provides just-in-time privileged access by allowing users to activate eligible Azure AD or Azure resource roles for a limited, configurable duration, with optional approval workflows, justification, and full audit logging. This eliminates standing privileges because administrators do not permanently hold high-privilege roles; instead, they request activation only when needed. PIM also can enforce MFA during activation and generate alerts for suspicious activity, making it the correct answer for time-bound privileged access with oversight.

This is the correct approach because Azure management groups provide hierarchical governance above subscriptions, allowing a single Azure Policy initiative assignment at the management group scope to apply automatically to all three child subscriptions. Placing all three subscriptions under one management group centralizes policy enforcement, while Azure RBAC remains independent of management groups and can be configured with a custom role whose assignable scope is limited to the Sales subscription. This separation means the custom role grants delegated administration only to Sales, without affecting Marketing or IT, and the policy initiative requiring, for example, specific resource tags or allowed locations applies uniformly across all departments. The combination leverages Azure's native inheritance model for policies and the granular, subscription-scoped access control of RBAC.

Activity Log records all control plane operations (create, update, delete, RBAC changes) for auditing.

The Modify effect is the only effect that can directly change a property of an existing Azure resource to remediate non-compliance. When paired with a role assignment in the policy definition, it enables automatic remediation tasks that update the resource configuration—such as enabling encryption on a storage account—without requiring manual intervention. It evaluates both during the create/update cycle and through proactive remediation runs.

Azure Cost Management + Billing is the dedicated service for financial governance across multiple subscriptions, providing a unified view of actual and forecasted spend. It supports creation of budgets, cost alerts, and detailed analysis by subscription, resource group, or tag. With its Power BI integration and exported cost data, it enables finance teams to track and control expenditures from a single pane of glass.

The 'modify and audit' pair is correct because 'modify' directly changes the storage account’s configuration to enforce 'Secure transfer required' during resource creation or update, while 'audit' captures a compliance record for any resource that remains or becomes non-compliant. 'modify' is a remediation effect that can alter an existing property, and for existing non-compliant accounts, a remediation task can apply the fix. Combined, these effects both log non-compliance and automatically set secure transfer to true, fully satisfying the policy requirement.

This built-in Azure Policy definition evaluates every create or update request against the rule and, with Deny mode, rejects any that lack the required tag before the deployment begins. Because it is evaluated by the policy engine at the ARM API level, it applies consistently to all resource types and all users. This is the correct, service-native mechanism for mandatory tag requirements.

The Audit effect in Azure Policy evaluates resources against the policy definition and writes a compliance event to the activity log without blocking the resource deployment or modification. This log entry can trigger Azure Monitor alerts and notifications, giving the company visibility into non-compliant resources. Since the company only wants to be notified, Audit is the correct effect because it does not interfere with the operator's workflow.

The Well-Architected Framework is a set of architectural guiding principles for building reliable, secure, and efficient cloud workloads. It is structured around five pillars—reliability, security, cost optimization, operational excellence, and performance efficiency—each with specific design strategies and evaluation criteria. The framework helps you make informed trade-offs and continuously improve your architecture using cross-cutting principles, rather than relying on one-time checks or certifications.

Azure Key Vault is the correct choice because ARM templates can dynamically reference Key Vault secrets at deployment time using the `reference` function with the secret's resource identifier. This enables secure injection of passwords, connection strings, or other sensitive values without embedding them in the template or parameter file. The deploying identity must have appropriate access (via access policies or RBAC) to the Key Vault, ensuring secrets are never exposed in logs or source control.

Correct. Management Groups allow you to assign Azure Policy at a high level (e.g., root management group) and have that policy automatically apply to all child subscriptions, including future subscriptions, ensuring consistent governance across the entire hierarchy.

Azure Service Level Agreements (SLAs) are formal contracts that specify the guaranteed uptime percentage (e.g., 99.9% for Standard tier) and connectivity availability for a service, along with defined service credits if Microsoft fails to meet these thresholds. These commitments directly govern performance reliability and are the core purpose of an SLA, distinct from regional or cost-related documentation.

The Audit effect evaluates resources for compliance and generates a warning event in the activity log, but does not block the resource operation. This allows the governance team to identify and report non-compliant VMs without interrupting the deployment process.

The Azure Policy compliance dashboard is the built-in Azure Portal view that aggregates the results of policy evaluations across assignments, initiatives, and scopes. It provides a compliance score and allows you to drill into each policy and the specific compliant or non-compliant resources. Because Azure Policy evaluates resource configuration against your defined business rules, this dashboard is exactly where you would observe the resulting compliance state.

The 'audit' effect creates a compliance report entry in the activity log and marks the resource as non-compliant in policy compliance, but does not block the resource creation or modify it. This meets the requirement to identify missing tags without disrupting deployment.

A Service Principal is an Azure AD identity created for a specific application or automated workload, such as a DevOps pipeline, a script, or a virtual machine extension. It provides the application with its own credentials (client secret, certificate, or assigned managed identity) and is assigned RBAC roles to access resources. Unlike a human user, it is designed for non-interactive authentication and can be tightly scoped to only the permissions its workload requires.

An Azure Policy Initiative (policy set definition) groups multiple individual policy definitions into a single bundle for assignment. This allows the governance team to assign all the tagging, VM SKU, and HTTPS policies together and view the overall compliance status across the management group from a single dashboard. This is exactly the feature described.

Assigning the role at the management group level is the correct approach because Azure RBAC role assignments on a management group are inherited by all subscriptions beneath it in the hierarchy. This includes any new subscriptions added to that management group in the future, so access remains consistent automatically. By selecting the specific management group that represents the Production hierarchy, you precisely scope the role to the intended subscriptions without affecting other environments.

Scoping the Virtual Machine Contributor role to the resource group grants the user exactly the permissions needed to manage virtual machines (create, start, stop, restart, delete, and manage extensions) while denying access to the underlying virtual network, storage accounts, and other resource group members. This is the correct implementation of least privilege because it restricts both the action scope (VM management only) and the resource scope (that specific resource group).

A Delete lock prevents deletion of the resource group and its resources while allowing all other operations, including modifications. This directly addresses the requirement to prevent accidental deletion without hindering updates. Resource locks can be applied at the resource group level and only removed by users with Owner or User Access Administrator roles.

Microsoft Purview is a unified data governance platform that automatically scans data sources across on-premises, Azure, and multi-cloud environments to build a data map. It applies built-in classifiers to detect and label sensitive information such as PII, financial data, and health records, and tracks data lineage for compliance. This makes Purview the correct service for discovering and classifying sensitive data at scale.

Azure Key Vault diagnostic logging is the feature that enables exporting the built-in audit event logs generated for every Key Vault operation, including attempts to access, create, update, delete, or list keys, secrets, and certificates. These logs capture the user or application principal, the timestamp, the source IP address, and the exact operation performed, and can be streamed to a Log Analytics workspace, Storage account, or Event Hub for centralized monitoring and compliance reporting. Enabling diagnostic settings on the vault is the correct and primary method to retain and query full audit trails of who accessed what within a specific Key Vault.

DeployIfNotExists is the correct effect because it evaluates each VM for the absence of a diagnostic settings resource and, when non-compliance is detected, deploys that required resource via an ARM template or linked deployment. With a remediation task triggered through Azure Policy – and a system-assigned managed identity granted the necessary permissions – this effect can automatically create diagnostic settings for all 200 existing VMs, fully automating remediation.

Azure Service Health is the correct choice because it provides a personalized dashboard of the health of Azure services and regions that your subscription actually uses. It aggregates current issues, past incidents, and, crucially, upcoming planned maintenance events that may affect your resources, and it allows you to set alerts for these events. This forward-looking view of planned maintenance is exactly what the company needs for their Azure VMs and SQL database.

DeployIfNotExists is the correct effect because it actively remediates non-compliant storage accounts by deploying a required definition (e.g., enabling encryption) at scale. It uses a managed identity to assess existing resources and apply the configuration automatically, covering both new and pre-existing accounts without manual intervention.

Policy Contributor is designed specifically for managing Azure Policy resources. It allows creating, updating, and deleting policy definitions, initiatives, and assignments. At the root management group scope, this role enables policy governance across all subscriptions without granting broader management capabilities.

An Azure Policy initiative definition (also known as a policy set) groups multiple related policy definitions into a single assignable unit. When assigned to a management group, subscription, or resource group, the initiative evaluates compliance as an aggregated set, so a fleet of hundreds of VMs can be assessed against a combined compliance posture (e.g., all VM security and configuration policies) in one dashboard. Initiatives also support the same remediation tasks and exemptions as individual policies, making them the appropriate construct for large-scale governance.

Azure Resource Graph is a service within Azure Resource Manager that supports high-performance, KQL-based queries across subscriptions, management groups, and resource types. It is specifically designed to explore and inventory Azure resources by returning properties such as resource names, locations, tags, and configuration settings at scale. This makes it the correct answer because it directly matches the service's primary purpose of resource discovery and inventory exploration.

Azure Standard support is a paid plan that grants unlimited 24/7 access to technical support engineers via phone, email, and web for all production issues. It is explicitly the lowest tier that includes around-the-clock technical support with no business-hour restrictions, making it the appropriate choice for a workload needing continuous engineer assistance. Its features directly match the question's requirement, confirming it as the correct answer.

Correct. Azure Advisor is a free service that continuously analyzes resource usage and provides personalized recommendations to optimize costs, security, reliability, performance, and operational excellence. It includes specific cost recommendations such as identifying idle VMs and rightsizing underutilized resources.

Azure Activity Log is a subscription-level platform log that records all control-plane operations performed on Azure resources. Each entry includes the principal (who initiated the action), the timestamp (when it occurred), the operation name (e.g., write, delete), and the resource affected, along with the request details and status. This makes it the authoritative source for answering questions about who made changes to a resource and when.

Azure Cost Management + Billing budgets are purpose-built to track spending against defined monetary thresholds at subscription, resource group, or management group scope. You can configure budget amounts, actual and forecasted cost threshold percentages, and trigger email alerts or automation via action groups when spending approaches or exceeds those levels. Because the service reads Azure billing and meter data, it directly fulfills the requirement to alert on subscription cost limits, unlike the general governance and telemetry tools in the other choices.

Azure Policy with the Deny effect evaluates resource creation or update requests and denies them if they do not comply with the policy rules (e.g., VM location). The denial includes a clear error message explaining which policy prevented the action. This is the standard method to enforce location restrictions proactively.

Azure Arc projects non-Azure resources, such as Windows and Linux servers, into Azure Resource Manager by installing the Connected Machine agent, which registers each machine as an Azure resource. Once registered, these resources appear in the Azure portal, can be controlled with Azure Policy, assigned RBAC permissions, and have guest configuration audited from Azure. This enables consistent governance and monitoring across on-premises, multi-cloud, and edge environments without moving workloads or requiring a separate Azure deployment.

The Deny effect is the only one that actively blocks non-compliant resource deployment. When Azure Policy evaluates a request with a Deny policy, the resource creation or update is rejected with an error before it is provisioned, ensuring every resource in scope must include the costcenter tag or it cannot be created at all.

Microsoft Sentinel is the correct choice because it is Azure's native, cloud-scale security information and event management (SIEM) and security orchestration, automated response (SOAR) service. It aggregates security data from any source—including users, applications, servers, and other clouds—and uses built-in AI and analytics to detect anomalies, while its playbooks enable automated response to threats. This directly matches the need for continuous security monitoring, threat detection, and response automation.

Azure Policy provides built-in definition 'Allowed locations' that evaluates the location of a new resource during deployment and only permits resources where the location matches the allowed list. The policy can be assigned at a management group, subscription, or resource group scope, and it denies or prevents resource creation outside the defined regions. This directly satisfies the scenario's goal of restricting deployment to specific regions. It also applies to all resource types that have a location property, giving admin control over geographical compliance.

Audit reports storage accounts that lack the required encryption as non-compliant, while DeployIfNotExists automatically assigns the encryption configuration to those resources and triggers a remediation task. Because DINE can act on existing resources, this combination both highlights compliance gaps and actively fixes them, which is why it is the correct enforcement approach.

Azure Advisor is a personalized cloud consulting service that continuously evaluates your Azure resources against best practices and provides actionable recommendations across cost, security, reliability, operational excellence, and performance. Its cost recommendations are derived from consumption telemetry—such as CPU and memory utilization over the past 7 days—and proactively flag idle or underutilized VMs, suggesting resizing or shutdown to optimize spend. Because these insights are generated automatically and surfaced in the Azure portal without custom scripting, Advisor is the built-in tool that directly addresses the finance team's need for cost optimization.

A 'CanNotDelete' lock allows read and update operations but blocks delete operations on the resource group. This lock applies to all users, including those with the Owner role, making it the correct governance control to prevent accidental or intentional deletion while allowing modifications.

The 'Deny' effect in Azure Policy actively blocks any resource creation or update that violates the policy definition, returning an error in the deployment or API call. For a disallowed VM size, Deny prevents the VM from being provisioned entirely, ensuring the security team's requirement is enforced before the resource exists. This effect is evaluated during resource creation/update and cannot be bypassed by the resource provider, making it the only option that truly stops non-compliant deployments.

An Azure Resource Manager CanNotDelete lock is the correct mechanism because it blocks any delete operation on the resource, resource group, or subscription where it is applied, regardless of the caller's RBAC role, including the subscription Owner. The lock overrides all permissions for the scoped resource, so even an Owner cannot delete it until the lock is explicitly removed. This lock still allows read and update operations, but it enforces that a locked resource must remain in place, making it the precise tool for preventing deletion.

Azure Resource Manager (ARM) is the deployment and management service that provides a consistent, unified control plane for all Azure resources. It enables you to deploy, group, tag, and apply access control across resources using templates, the portal, PowerShell, or the CLI. Every management operation in Azure goes through ARM, making it the single source of truth for resource hierarchy and organization.