CCNA Describe Azure management and governance Questions — Page 4 of 5

226

MCQhard

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

A.Only the policy at the Europe level applies

B.Only the policy at the Root level applies

C.Both policies apply

D.The policy at the lower level overrides the Root policy

AnswerC

Policies assigned at different levels in the management group hierarchy all apply to child subscriptions.

Why this answer

Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence.

Therefore, the Production subscription is subject to both policies.

Exam trap

The trap here is that candidates often confuse Azure Policy inheritance with role-based access control (RBAC) inheritance, where a lower-level assignment can override a higher-level one, but Azure Policy is cumulative and does not support override behavior.

How to eliminate wrong answers

Option A is wrong because it assumes that a policy at a lower level (Europe) replaces higher-level policies, but Azure Policy inheritance is additive, not exclusive. Option B is wrong because it ignores the fact that the Europe-level policy is also inherited by the Production subscription, so both policies apply. Option D is wrong because Azure Policy does not support overriding; policies are cumulative, and if there is a conflict, the most restrictive effect (e.g., 'Deny' overrides 'Audit') is applied, but both policies remain in effect.

Practice this question →

227

MCQmedium

A company has an Azure subscription that hosts multiple virtual machines, databases, and storage accounts. The finance team wants to receive an automated email notification when the forecasted monthly spending for the subscription exceeds $10,000. The team needs to use a native Azure feature that can track actual and forecasted costs and trigger alerts based on a monetary threshold. The solution must not require custom scripts or third-party tools. Which Azure feature should the team configure?

A.Azure Advisor

B.Azure Budgets

C.Azure Policy

D.Azure Resource Graph

AnswerB

Azure Budgets is a feature within Azure Cost Management that enables you to set spending limits and configure email alerts when actual or forecasted costs exceed the defined budget amount. It supports both actual and forecasted cost triggers, making it the correct solution for this scenario.

Why this answer

Azure Budgets is the correct native feature because it allows you to set a monetary threshold (e.g., $10,000) for forecasted or actual costs, and it can automatically trigger an email alert when that threshold is reached. It integrates directly with Azure Cost Management and requires no custom scripts or third-party tools, meeting the finance team's requirements exactly.

Exam trap

The trap here is that candidates often confuse Azure Advisor's cost recommendations with the ability to set cost alerts, but Advisor only suggests optimizations and does not provide threshold-based alerting like Azure Budgets does.

How to eliminate wrong answers

Option A is wrong because Azure Advisor provides personalized recommendations for cost optimization, security, and reliability, but it does not have the capability to set monetary thresholds or send automated alerts based on forecasted spending. Option C is wrong because Azure Policy enforces compliance rules on resource configurations (e.g., allowed locations or SKUs) and cannot track costs or trigger alerts based on spending thresholds.

Practice this question →

228

MCQmedium

Which Azure governance feature allows you to create a repeatable, deployable package of Azure resources, role assignments, and policies for new subscriptions?

A.Azure Resource Manager templates

B.Azure Policy

C.Azure Blueprints

D.Azure Management Groups

AnswerC

Blueprints bundle templates, policies, and RBAC into repeatable, auditable packages for new subscription setup.

Why this answer

Azure Blueprints is the correct answer because it is specifically designed to orchestrate the deployment of a repeatable, deployable package that includes Azure Resource Manager templates, role assignments, and policies. Unlike a single ARM template, Blueprints enables you to define a set of standard Azure resources and governance artifacts that can be applied consistently to new subscriptions, ensuring compliance and organizational standards from the start.

Exam trap

The trap here is that candidates often confuse Azure Blueprints with Azure Policy or ARM templates, but Blueprints is the only service that combines resource deployment, policy enforcement, and role assignment into a single, repeatable package for new subscriptions.

How to eliminate wrong answers

Option A is wrong because Azure Resource Manager templates are declarative JSON files that deploy infrastructure as code, but they cannot natively include role assignments or policy definitions as part of a repeatable subscription-level package. Option B is wrong because Azure Policy is used to enforce rules and effects on existing resources, not to deploy a bundle of resources, roles, and policies together. Option D is wrong because Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying policies at scale, but they do not package and deploy resources or role assignments.

Practice this question →

229

MCQeasy

What is Azure Active Directory Conditional Access?

A.A feature that blocks all access to Azure resources from outside the organization

B.A policy engine that enforces access rules based on conditions like location, device, and risk

C.A tool for encrypting user data in Azure AD

D.A way to provision users automatically in Azure AD

AnswerB

Conditional Access enforces context-aware access policies (e.g., require MFA from untrusted locations).

Why this answer

Azure Active Directory Conditional Access is a policy engine that evaluates signals such as user location, device compliance, and sign-in risk to enforce access rules before granting access to resources. It allows organizations to implement granular controls like requiring multi-factor authentication (MFA) from untrusted networks or blocking access from non-compliant devices, making it a core identity-driven security feature.

Exam trap

The trap here is that candidates confuse Conditional Access with a simple 'block all' feature (Option A) or assume it handles provisioning (Option D), when in fact it is a conditional policy engine that evaluates multiple signals to grant or deny access with granular controls.

How to eliminate wrong answers

Option A is wrong because Conditional Access does not block all access from outside the organization; it evaluates conditions and can allow access with additional controls (e.g., MFA) rather than a blanket block. Option C is wrong because Conditional Access is not an encryption tool; Azure AD uses technologies like BitLocker and Azure Information Protection for data encryption, not Conditional Access policies. Option D is wrong because user provisioning is handled by Azure AD Connect or Microsoft Identity Manager, not by Conditional Access, which focuses on access control decisions after identity is established.

Practice this question →

230

MCQhard

Which Azure feature allows you to save money on Azure SQL Database and Azure SQL Managed Instance using existing on-premises SQL Server licenses?

A.Azure Reserved Instances

B.Azure Hybrid Benefit

C.Azure Spot VMs

D.Azure Dev/Test pricing

AnswerB

Azure Hybrid Benefit lets you use existing SQL Server licenses with SA to reduce Azure SQL costs by up to 30%.

Why this answer

Azure Hybrid Benefit allows you to use your existing on-premises SQL Server licenses with Software Assurance to reduce the cost of Azure SQL Database and Azure SQL Managed Instance. By applying this benefit, you pay only for the underlying compute infrastructure at the base compute rate, effectively saving up to 55% on SQL licensing costs. This is specifically designed to maximize value from existing license investments when migrating to Azure.

Exam trap

The trap here is that candidates often confuse Azure Hybrid Benefit with Azure Reserved Instances, thinking both are purely discount mechanisms, but Hybrid Benefit specifically reuses existing licenses whereas Reserved Instances only commit to future spend without license portability.

How to eliminate wrong answers

Option A is wrong because Azure Reserved Instances provide a discount on compute costs in exchange for a one- or three-year commitment, but they do not leverage existing on-premises SQL Server licenses. Option C is wrong because Azure Spot VMs offer deeply discounted compute capacity for interruptible workloads, but they are not applicable to Azure SQL Database or SQL Managed Instance and have no relation to license reuse. Option D is wrong because Azure Dev/Test pricing offers discounted rates for development and testing environments, but it requires Visual Studio subscriptions and does not allow using existing on-premises SQL Server licenses for production workloads.

Practice this question →

231

MCQmedium

What does the Azure SLA guarantee for a single Virtual Machine with Premium SSD disk?

A.99% uptime per month

B.99.9% uptime per month

C.99.95% uptime per month

D.99.99% uptime per month

AnswerB

A single VM with Premium SSD has a 99.9% SLA (~8.7 hours maximum downtime per year).

Why this answer

The Azure SLA for a single Virtual Machine with Premium SSD disk guarantees 99.9% uptime per month. This is because Premium SSDs are part of the 'single instance VM' SLA tier, which requires the VM to use Premium SSD or Ultra Disk storage and have all OS and data disks on that tier. The 99.9% SLA applies when the VM is deployed with at least two instances in an availability set or availability zone, but for a single instance with Premium SSD, the SLA is 99.9% (not higher) because it lacks redundancy against host or rack failures.

Exam trap

The trap here is that candidates often confuse the SLA for a single VM with Premium SSD (99.9%) with the higher SLA for multi-instance deployments (99.95% or 99.99%), or they mistakenly think Premium SSD alone guarantees 99.99% uptime.

How to eliminate wrong answers

Option A is wrong because 99% uptime per month is the SLA for a single VM using Standard HDD or Standard SSD disks, not Premium SSD. Option C is wrong because 99.95% uptime per month applies only to VMs deployed in an availability set or availability zone with at least two instances, not to a single VM. Option D is wrong because 99.99% uptime per month is the SLA for VMs deployed in an availability zone with at least two instances and using Premium SSD, or for Azure SQL Database, not for a single VM.

Practice this question →

232

MCQhard

A company uses Azure Blueprints to define a standard environment. They publish a new version of the blueprint with an updated role assignment. All existing subscriptions that were created from an older version need to receive the new role assignment. What should they do?

A.Reassign the blueprint to each subscription manually

B.The blueprint updates automatically

C.Manually add the role assignment to each subscription

D.Use the 'Update existing assignments' option

AnswerD

This applies the latest blueprint version to all existing assignments.

Why this answer

Option D is correct because Azure Blueprints provides a built-in 'Update existing assignments' option that propagates changes from a published blueprint version to all existing assigned subscriptions. This ensures that updated role assignments are applied without manual intervention, maintaining consistency across the environment.

Exam trap

The trap here is that candidates assume blueprint updates are automatically applied to existing assignments, but Azure Blueprints requires an explicit update action to propagate changes, unlike Azure Policy which can auto-remediate.

How to eliminate wrong answers

Option A is wrong because reassigning the blueprint manually to each subscription is redundant and inefficient; the 'Update existing assignments' feature automates this process. Option B is wrong because blueprint updates do not automatically propagate to existing assignments; you must explicitly trigger the update. Option C is wrong because manually adding the role assignment to each subscription bypasses the blueprint's governance model and defeats the purpose of using Blueprints for centralized management.

Practice this question →

233

MCQhard

An organization wants to ensure that no one can create Azure resources outside of approved geographic locations across all of their subscriptions. What is the most scalable way to enforce this?

A.Configure RBAC to deny resource creation permissions in all subscriptions

B.Assign 'Allowed locations' Azure Policy at the Management Group level

C.Create separate 'Allowed locations' policies in each subscription

D.Use Azure Blueprints to restrict locations in each new subscription

AnswerB

Management Group policy assignment propagates to all child subscriptions, providing enterprise-wide location enforcement.

Why this answer

Azure Policy at the Management Group level allows you to define a single 'Allowed locations' policy that applies to all subscriptions within that group, ensuring consistent enforcement across the entire organization. This approach is the most scalable because it centralizes governance, automatically covering new subscriptions added to the management group without manual intervention.

Exam trap

The trap here is confusing Azure Policy with RBAC or Azure Blueprints, leading candidates to choose options that manage permissions or deployments instead of the centralized, policy-based enforcement that Azure Policy provides at the management group scope.

How to eliminate wrong answers

Option A is wrong because RBAC (Role-Based Access Control) controls who can perform actions, not what resources can be created or where; denying permissions would prevent all resource creation, not just restrict locations. Option C is wrong because creating separate policies in each subscription is not scalable—it requires manual effort for each subscription and does not automatically apply to new subscriptions. Option D is wrong because Azure Blueprints are used to deploy and orchestrate resources consistently, not to enforce ongoing compliance restrictions like location limits; they are a deployment tool, not a continuous enforcement mechanism.

Practice this question →

234

MCQeasy

A company has an Azure policy requirement that all new resources in a specific resource group must have a 'Department' tag. If a resource is created without this tag, the tag should be automatically added with a default value of 'Finance'. Which Azure Policy effect should be used?

A.Deny

B.Append

C.Audit

D.Modify

AnswerB

Append adds the missing tag during resource creation, meeting the requirement to automatically apply the default tag.

Why this answer

The Append effect is correct because it allows Azure Policy to automatically add a 'Department' tag with a default value of 'Finance' to any resource created without it in the specified resource group. This effect modifies the resource during creation or update to enforce compliance without blocking the operation.

Exam trap

The trap here is that candidates often confuse Append with Deny, thinking that blocking non-compliant resources is the only way to enforce tagging, but Append provides a non-blocking remediation that satisfies the requirement to automatically add the tag.

How to eliminate wrong answers

Option A is wrong because Deny prevents the creation of resources that do not meet the policy condition, but the requirement is to automatically add the missing tag, not block the resource. Option C is wrong because Audit only logs non-compliant resources without taking any corrective action, so it would not add the tag automatically.

Practice this question →

235

MCQmedium

A company has multiple Azure subscriptions. They need to enforce a rule that only specific virtual machine sizes (e.g., Standard_D2s_v3) can be used across all subscriptions. They also want this rule to automatically apply to any future subscriptions created. Which Azure service should they use?

A.Azure Policy

B.Azure Blueprints

C.Azure Role-Based Access Control (RBAC)

D.Azure Resource Manager

AnswerA

Correct. Azure Policy enforces organizational standards and can restrict allowed VM sizes. Policies assigned to a management group apply to all subscriptions under it.

Why this answer

Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules (such as allowed virtual machine SKUs) across your Azure environment. By assigning a built-in or custom policy definition (e.g., 'Allowed virtual machine SKUs') at the management group scope, the rule automatically applies to all existing and future subscriptions within that management group, ensuring consistent governance without manual intervention.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces rules on resource properties) with Azure Blueprints (which packages multiple resources for deployment) or RBAC (which controls user permissions), but the question specifically requires automatic enforcement across all subscriptions, which only Azure Policy with management group assignment can achieve.

How to eliminate wrong answers

Option B (Azure Blueprints) is wrong because Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates as a repeatable package, but they do not natively enforce rules across all subscriptions automatically; they require explicit assignment and do not dynamically apply to future subscriptions unless the blueprint is reassigned. Option C (Azure Role-Based Access Control) is wrong because RBAC manages who has access to Azure resources and what actions they can perform (authorization), not what resource configurations are allowed (like VM sizes); RBAC cannot enforce a rule that restricts specific VM SKUs across subscriptions.

Practice this question →

236

MCQmedium

A company has a critical production resource group that contains several virtual machines and an Azure SQL Database. The IT manager wants to prevent anyone from accidentally deleting the resource group or any of its resources. However, authorized administrators must still be able to add, update, or delete individual resources within the group (except deletion of the group itself). Which Azure feature should the manager apply to the resource group?

A.Apply an Azure Policy with the 'Deny' effect to prevent all operations on the resource group.

B.Apply a Read-Only lock on the resource group.

C.Apply a CanNotDelete lock on the resource group.

D.Remove the Contributor role from all users and assign the Owner role to the IT manager only.

AnswerC

A CanNotDelete lock allows all operations (read, create, update, delete of individual resources) except the deletion of the locked scope (the resource group in this case). This exactly matches the requirement: authorized administrators can manage resources normally, but the entire resource group and all its resources are protected from accidental deletion. This is the correct choice.

Why this answer

Option C is correct because a CanNotDelete lock on the resource group prevents deletion of the group itself while still allowing authorized administrators to add, update, or delete individual resources within the group. This lock type specifically blocks delete operations on the locked scope, but does not restrict read, write, or other management operations, aligning perfectly with the requirement to protect the resource group from accidental deletion while permitting ongoing resource management.

Exam trap

The trap here is that candidates often confuse Azure Policy with resource locks, mistakenly thinking a Deny policy can be scoped to only block deletion, when in fact Azure Policy effects like 'Deny' apply to all operations defined in the policy rule, not just delete actions, whereas a CanNotDelete lock is specifically designed to block only deletion at the resource group or resource level.

How to eliminate wrong answers

Option A is wrong because an Azure Policy with the 'Deny' effect would block all operations (including add, update, and delete) on the resource group and its resources, which is too restrictive and contradicts the requirement that authorized administrators must be able to manage individual resources. Option B is wrong because a Read-Only lock prevents any modification (add, update, or delete) to the resource group and its resources, which would block the authorized administrators from performing the required management tasks, not just deletion.

Practice this question →

237

MCQmedium

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

A.Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action

B.Azure Policy with the 'Deny' effect

C.Azure Blueprints with a resource lock

D.Azure resource locks at the resource group level

AnswerB

Azure Policy with the 'Deny' effect is the correct solution. A policy definition can specify allowed VM SKU sizes using conditions. When assigned to a scope (e.g., subscription or resource group), any deployment of a VM that does not comply with the condition is blocked before the resource is created. This is the appropriate service for enforcing rules on resource configuration.

Why this answer

Azure Policy with the 'Deny' effect is the correct choice because it allows the governance team to define and enforce rules that prevent the deployment of non-compliant resources, such as VMs with disallowed SKU sizes. When a policy with the 'Deny' effect is assigned, any attempt to create or update a resource that violates the policy is blocked immediately, and the user receives a clear error message explaining the restriction. This is the only Azure feature that provides proactive, resource-level enforcement with a built-in denial mechanism.

Exam trap

The trap here is that candidates often confuse Azure Policy with Azure RBAC, thinking that RBAC can filter by resource properties, but RBAC only controls access to actions (e.g., write) at a scope, not the specific configuration of the resource being created.

How to eliminate wrong answers

Option A is wrong because Azure RBAC with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action would block all VM deployments, not just those with specific SKU sizes, and it cannot evaluate resource properties like SKU size. Option C is wrong because Azure Blueprints with a resource lock is used to prevent accidental deletion or modification of resources, not to enforce deployment restrictions based on resource properties like VM SKU sizes. Option D is wrong because Azure resource locks at the resource group level only prevent deletion or modification of resources within that group, and they cannot block the creation of resources with specific properties.

Practice this question →

238

MCQeasy

Which Azure feature provides a unified compliance score and consolidated view of your organization's compliance posture across different regulatory standards?

A.Azure Policy

B.Microsoft Defender for Cloud

C.Azure Blueprints

D.Azure Active Directory

AnswerB

Defender for Cloud includes a Regulatory Compliance dashboard showing your compliance score against multiple standards.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified compliance score and a consolidated view of your organization's compliance posture across multiple regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS). It continuously assesses your Azure and hybrid workloads against these standards, calculates a compliance score based on the percentage of compliant controls, and offers actionable recommendations to improve your overall security and compliance posture.

Exam trap

The trap here is that candidates often confuse Azure Policy's compliance dashboard (which shows per-policy compliance) with Defender for Cloud's multi-standard compliance score, leading them to select Azure Policy because it also has a 'compliance' tab, but it lacks the aggregated, cross-standard scoring and regulatory-specific views that Defender for Cloud provides.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a service that enforces organizational standards and assesses compliance at the resource level using policy definitions and initiatives, but it does not provide a unified compliance score or a consolidated view across different regulatory standards—it focuses on rule enforcement and auditing, not multi-standard compliance scoring. Option C is wrong because Azure Blueprints is used to define a repeatable set of Azure resources and policies (including role assignments, policy assignments, and resource groups) for deploying compliant environments, but it does not generate a compliance score or aggregate compliance posture across standards; it is a deployment orchestration tool, not a monitoring/assessment tool. Option D is wrong because Azure Active Directory (Azure AD) is a cloud-based identity and access management service that handles authentication, authorization, and directory services; it does not provide compliance scoring or regulatory compliance assessments.

Practice this question →

239

MCQmedium

A company requires that all resources deployed in a production Azure subscription must include a 'Department' tag. Resources without this tag must be automatically prevented from being created. Which Azure service should the company use to enforce this requirement?

A.Azure Policy

B.Azure Blueprints

C.Azure Resource Manager

D.Azure Cost Management

AnswerA

Correct. Azure Policy can enforce rules on resources during creation and throughout their lifecycle. By assigning a policy with a 'deny' effect that requires a specific tag, any attempt to create a resource without that tag will be blocked.

Why this answer

Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can define a policy that requires the 'Department' tag on all resources, and configure a deny effect to automatically prevent the creation of any resource that does not include this tag. This ensures compliance at the time of resource creation, without manual intervention.

Exam trap

The trap here is that candidates often confuse Azure Policy with Azure Blueprints, thinking Blueprints can enforce real-time compliance, when in fact Blueprints only deploys policies and other artifacts but relies on Azure Policy for the actual enforcement and denial of non-compliant resources.

How to eliminate wrong answers

Option B (Azure Blueprints) is wrong because Azure Blueprints is used to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates into a subscription, but it does not itself enforce real-time compliance or deny creation of non-compliant resources; it relies on Azure Policy for that enforcement. Option C (Azure Resource Manager) is wrong because Azure Resource Manager is the deployment and management service for Azure, providing a consistent management layer for creating, updating, and deleting resources, but it does not have built-in capabilities to enforce tagging requirements or deny resource creation based on policy conditions.

Practice this question →

240

MCQmedium

Which Azure feature allows you to set a maximum amount that can be spent on Azure services within a billing period?

A.Azure Spending Limit

B.Azure Budgets

C.Azure Reserved Instances

D.Azure Quota limits

AnswerB

Azure Budgets set spending thresholds with email alerts and optional automated actions when limits are approached.

Why this answer

Azure Budgets allows you to set a maximum spending limit and receive alerts when costs exceed defined thresholds, enabling proactive cost management within a billing period. Unlike the Azure Spending Limit, which is a hard cap for free trial and credit-based subscriptions, Budgets provides configurable notifications and can trigger automation, such as disabling resources, when spending approaches or exceeds the budget. This makes Budgets the correct feature for setting a maximum amount that can be spent, as it directly monitors and alerts on actual usage against a defined budget.

Exam trap

The trap here is that candidates confuse the Azure Spending Limit (a hard cap that stops services) with Azure Budgets (a configurable alerting and automation tool), because both involve spending limits, but only Budgets allows custom thresholds and proactive notifications without automatically disabling services.

How to eliminate wrong answers

Option A is wrong because Azure Spending Limit is a fixed, non-configurable cap that only applies to free trial, Pay-As-You-Go with credits, or Visual Studio subscriptions, and it stops service usage entirely when the limit is reached, rather than allowing you to set a custom maximum amount with alerts. Option C is wrong because Azure Reserved Instances provide a discount on compute resources in exchange for a one- or three-year commitment, but they do not set a spending limit or cap on total costs. Option D is wrong because Azure Quota limits are per-subscription or per-service resource caps (e.g., number of VMs per region) that prevent resource creation beyond a threshold, but they are not designed to control monetary spending or set a maximum billing amount.

Practice this question →

241

MCQmedium

What is the purpose of Azure Marketplace?

A.A catalog for browsing and purchasing third-party software and solutions that run on Azure

B.A store for buying Azure hardware for on-premises use

C.A repository for sharing Azure Resource Manager templates with other organizations

D.A portal for comparing prices across different cloud providers

AnswerA

Azure Marketplace offers certified third-party software and solutions deployable directly on Azure.

Why this answer

Azure Marketplace is an online catalog that allows customers to browse, purchase, and deploy third-party software, services, and solutions that are certified to run on Azure. It provides pre-configured solutions from independent software vendors (ISVs) and simplifies deployment by integrating directly with the Azure portal and Azure Resource Manager.

Exam trap

The trap here is that candidates confuse Azure Marketplace with a general cloud comparison tool or a template-sharing repository, when in fact it is specifically a catalog for deploying third-party solutions that run on Azure.

How to eliminate wrong answers

Option B is wrong because Azure Marketplace does not sell physical hardware for on-premises use; Azure hardware procurement is handled through separate channels like Microsoft hardware partners or Azure Stack Hub. Option C is wrong because while Azure Marketplace can include Azure Resource Manager templates as part of a solution, its primary purpose is not a repository for sharing templates with other organizations—that is the role of the Azure Quickstart Templates gallery or GitHub. Option D is wrong because Azure Marketplace is not a price comparison portal across different cloud providers; it is specific to Azure and focuses on deploying solutions within the Azure ecosystem.

Practice this question →

242

MCQmedium

A company needs to find all virtual machines that have the tag 'Environment:Production' and were created more than 6 months ago. They want to run a complex query across all subscriptions in their tenant. Which Azure tool should they use?

A.Azure Resource Graph

B.Azure CLI

C.Azure PowerShell

D.Azure Cost Management

AnswerA

Correct. Azure Resource Graph provides a powerful query language to search, filter, and aggregate resources across subscriptions based on properties like tags and creation date.

Why this answer

Azure Resource Graph is the correct tool because it is designed to efficiently query across multiple subscriptions, resource groups, and resource types using the Kusto Query Language (KQL). It can filter virtual machines by the tag 'Environment:Production' and compare the 'createdTime' property to a date six months ago, all in a single, complex query that spans the entire tenant.

Exam trap

The trap here is that candidates often confuse Azure Resource Graph with Azure CLI or PowerShell because all three can query resources, but only Resource Graph is purpose-built for complex, cross-subscription queries using KQL, while the others are imperative tools that require manual iteration and lack native query optimization.

How to eliminate wrong answers

Option B is wrong because Azure CLI is a command-line tool for managing individual Azure resources, but it lacks native support for cross-subscription queries; you would need to write scripts to iterate over subscriptions, which is inefficient and not designed for complex, tenant-wide queries. Option C is wrong because Azure PowerShell, like Azure CLI, operates on a per-subscription or per-resource basis and does not provide a built-in query language for running complex, cross-subscription queries; it would require manual looping and filtering, making it less suitable for this task.

Practice this question →

243

MCQmedium

A company wants to receive notifications when Azure services in their region experience an outage or planned maintenance that might affect their resources. Which Azure service should they set up alerts for?

A.Azure Monitor

B.Azure Service Health

C.Azure Advisor

D.Azure Resource Health

AnswerB

Service Health gives you a personalized view of the health of Azure services in the regions you use, including outages and planned maintenance.

Why this answer

Azure Service Health is the correct service because it provides personalized alerts and notifications specifically for Azure service issues—such as outages and planned maintenance—that affect your subscriptions and resources in a given region. It combines global service health information with region-specific and resource-specific impacts, allowing you to configure alerts via Azure Service Health alerts (formerly known as Service Health Alerts).

Exam trap

The trap here is that candidates often confuse Azure Monitor (which handles resource-level alerts) with Azure Service Health (which handles Azure platform-level alerts), leading them to choose Azure Monitor for outage notifications when Service Health is the dedicated service for that purpose.

How to eliminate wrong answers

Option A is wrong because Azure Monitor is a general-purpose monitoring platform for collecting metrics, logs, and setting alerts on resource performance and availability, but it does not natively provide notifications for Azure platform-level outages or planned maintenance. Option C is wrong because Azure Advisor is a personalized recommendation engine that offers best-practice guidance on cost, security, reliability, and performance, but it does not send alerts for service outages or maintenance events. Option D is wrong because Azure Resource Health focuses on the health of individual resources (e.g., a specific VM or database) and reports on resource-level issues, not on broader Azure service outages or planned maintenance that affect an entire region.

Practice this question →

244

MCQmedium

Which Azure feature enables you to create custom roles with specific permissions when built-in RBAC roles do not meet your requirements?

A.Azure AD application permissions

B.Custom RBAC role definitions

C.Azure Policy custom definitions

D.Azure AD group membership rules

AnswerB

Custom RBAC roles allow defining precise permissions beyond what built-in roles provide.

Why this answer

Custom RBAC role definitions allow you to create roles with granular permissions tailored to your specific needs when built-in roles are insufficient. This Azure feature uses JSON-based role definitions that specify actions, notActions, dataActions, and assignable scopes to control access to Azure resources.

Exam trap

The trap here is confusing Azure Policy (which enforces compliance rules) with RBAC (which controls access permissions), leading candidates to select Azure Policy custom definitions instead of custom RBAC roles.

How to eliminate wrong answers

Option A is wrong because Azure AD application permissions are used to grant access to Azure AD resources (like Graph API) for applications, not to create custom roles for Azure resource management. Option C is wrong because Azure Policy custom definitions enforce compliance rules (e.g., tagging or location restrictions) on resources, not assignable permissions for user/group access control. Option D is wrong because Azure AD group membership rules (dynamic groups) automate user membership based on attributes, but they do not define or assign custom permissions to Azure resources.

Practice this question →

245

MCQmedium

Which feature of Azure subscriptions allows an organization to separate billing and access management for different departments?

A.Resource groups

B.Multiple subscriptions

C.Azure tags

D.Azure RBAC

AnswerB

Each subscription is a separate billing and access boundary, allowing departmental separation of costs and permissions.

Why this answer

Multiple subscriptions allow an organization to create separate billing invoices and independent access management boundaries for different departments. Each subscription has its own billing relationship and can be assigned distinct Azure AD tenants or RBAC configurations, enabling cost tracking and administrative isolation per department.

Exam trap

The trap here is that candidates confuse Azure tags or resource groups as mechanisms for separating billing and access, when in fact only multiple subscriptions provide independent billing and administrative boundaries.

How to eliminate wrong answers

Option A is wrong because resource groups are logical containers for resources within a single subscription and do not provide separate billing or access management across departments. Option C is wrong because Azure tags are metadata key-value pairs used for organizing resources and cost reporting, but they cannot enforce separate billing or access management boundaries. Option D is wrong because Azure RBAC provides fine-grained access control within a subscription or resource group, but it operates within a single subscription and cannot create separate billing or administrative isolation for different departments.

Practice this question →

246

MCQeasy

Which Azure support plan provides a dedicated Technical Account Manager and a 15-minute response time for critical business impact issues?

A.Business

B.Enterprise On-Ramp

C.Enterprise

D.Developer

AnswerC

Enterprise Support provides a dedicated TAM and 15-minute initial response time for critical (Severity A) issues.

Why this answer

The Enterprise support plan is the only Azure plan that includes a dedicated Technical Account Manager (TAM) and guarantees a 15-minute response time for critical business impact issues (severity A). This plan is designed for large-scale enterprise customers who require proactive guidance and rapid escalation handling.

Exam trap

The trap here is that candidates often confuse the Enterprise On-Ramp plan's shared TAM and 30-minute critical response with the Enterprise plan's dedicated TAM and 15-minute response, or they mistakenly think the Business plan includes a TAM because it is a paid tier.

How to eliminate wrong answers

Option A is wrong because the Business support plan provides a 1-hour response time for critical issues and does not include a dedicated Technical Account Manager. Option B is wrong because the Enterprise On-Ramp plan offers a 30-minute response time for critical issues and includes a TAM only as a shared resource, not dedicated. Option D is wrong because the Developer support plan has a maximum response time of 8 hours for critical issues and does not provide any TAM or proactive services.

Practice this question →

247

MCQmedium

A company wants to ensure that all resources in their Azure environment are created with mandatory tags for cost tracking. They have already assigned a policy to append tags, but existing resources are still missing tags. They want to automatically add the tags to existing resources without manual intervention. What should they do?

A.Modify the policy effect to 'deny' instead of 'append'.

B.Create a remediation task for the policy.

C.Use Azure Resource Graph to identify and manually tag.

D.Reassign the policy with a new scope.

AnswerB

Remediation tasks automatically apply the 'deployIfNotExists' or 'modify' effect to existing non-compliant resources.

Why this answer

A remediation task is the correct solution because Azure Policy's 'append' effect only applies to new or updated resources. To automatically add the missing tags to existing non-compliant resources, you must create a remediation task that triggers a deployment to apply the policy's 'deployIfNotExists' or 'modify' effect. This task runs on demand or on a schedule to bring existing resources into compliance without manual intervention.

Exam trap

The trap here is that candidates confuse the 'append' effect's behavior (which only applies to new/modified resources) with a retroactive fix, leading them to incorrectly choose reassignment or effect changes instead of recognizing the need for a remediation task.

How to eliminate wrong answers

Option A is wrong because changing the policy effect to 'deny' would block creation of untagged resources but would not add tags to existing resources; it only prevents future non-compliance. Option C is wrong because using Azure Resource Graph to identify resources and manually tag them contradicts the requirement for 'without manual intervention'; it is a manual process. Option D is wrong because reassigning the policy with a new scope does not retroactively apply the 'append' effect to existing resources; the scope change only affects resources within the new scope going forward.

Practice this question →

248

MCQmedium

Which Azure feature allows organizations to apply the same governance at a hierarchy of subscriptions and resource groups?

A.Azure Resource Locks inheritance

B.Azure Policy and RBAC inheritance through the management hierarchy

C.Azure Blueprints auto-assignment

D.Azure Cost Management budget inheritance

AnswerB

Policies and RBAC assigned at Management Group or Subscription scope are inherited by all child scopes.

Why this answer

Azure Policy and RBAC (Role-Based Access Control) inheritance through the management hierarchy allows organizations to apply consistent governance across multiple subscriptions and resource groups. When a policy or RBAC assignment is applied at a management group, it is inherited by all child subscriptions and resource groups, ensuring uniform compliance and access control without manual reconfiguration.

Exam trap

The trap here is that candidates often confuse Azure Resource Locks inheritance (which does not exist) with the hierarchical inheritance of Azure Policy and RBAC, or mistakenly think Azure Blueprints auto-assignment is the mechanism for inheritance rather than a deployment tool.

How to eliminate wrong answers

Option A is wrong because Azure Resource Locks (e.g., CanNotDelete, ReadOnly) are applied at a single resource, resource group, or subscription scope and do not inherently inherit across a hierarchy of subscriptions and resource groups; they must be explicitly applied at each level. Option C is wrong because Azure Blueprints auto-assignment is a packaging and deployment mechanism for templates, policies, and RBAC, but the inheritance of governance itself is achieved through the management group hierarchy and Azure Policy/RBAC inheritance, not through Blueprints' auto-assignment feature. Option D is wrong because Azure Cost Management budgets are scoped to a single subscription or resource group and do not inherit across a management hierarchy; they must be created individually for each scope.

Practice this question →

249

MCQmedium

A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?

A.Deny

B.Audit

C.DeployIfNotExists

D.Append

AnswerC

The DeployIfNotExists effect automatically deploys a resource (in this case, an NSG and its association to the subnet) when a VNet is created without it. This ensures compliance without manual effort from developers, matching the requirement exactly.

Why this answer

The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.

Exam trap

The trap here is that candidates often confuse DeployIfNotExists with Deny, thinking that blocking non-compliant resources is the only way to enforce compliance, but the question explicitly requires automatic association without extra steps, which only DeployIfNotExists can achieve through remediation.

How to eliminate wrong answers

Option A is wrong because Deny prevents the creation of VNets that do not meet the condition, but it cannot automatically associate an NSG with the default subnet after creation; it would block VNet creation entirely if the NSG is missing, which is not the desired behavior. Option B is wrong because Audit only logs non-compliant resources for monitoring and reporting, but it does not perform any automatic remediation or deployment of the required NSG, leaving developers to manually fix the issue.

Practice this question →

250

MCQeasy

Which Azure support option provides technical support through community forums and documentation only?

A.Developer support

B.Basic support

C.Business support

D.Enterprise support

AnswerB

Basic support is free and provides community forums, documentation, and health status — no direct engineer support.

Why this answer

Basic support is the free tier included with every Azure subscription. It provides access only to community forums, documentation, and billing support, with no technical support from Microsoft engineers. This makes it the correct answer for support limited to community forums and documentation.

Exam trap

The trap here is that candidates often assume 'Basic' means minimal but still includes some engineer support, when in fact it provides zero technical support from Microsoft engineers, only community forums and documentation.

How to eliminate wrong answers

Option A is wrong because Developer support includes technical support from Microsoft engineers during business hours for development environments, not just community forums and documentation. Option C is wrong because Business support offers 24/7 technical support with faster response times for production environments, far beyond forums and documentation. Option D is wrong because Enterprise support provides proactive guidance, a designated Technical Account Manager (TAM), and the fastest response times for critical workloads, not just community forums and documentation.

Practice this question →

251

MCQmedium

A company has a policy that every Azure resource must have a 'CostCenter' tag assigned at creation time. The governance team wants to automatically prevent any resource creation if the tag is missing, without requiring manual review after deployment. Which Azure feature should they use to enforce this requirement?

A.Azure Policy

B.Azure Blueprints

C.Azure Role-Based Access Control (RBAC)

D.Azure Tags

AnswerA

Correct. Azure Policy can enforce tagging rules at resource creation time by using a policy definition with a 'Deny' effect. This ensures that resources without the required tag are automatically blocked from being created.

Why this answer

Azure Policy is correct because it enables the enforcement of organizational standards by evaluating resources against custom or built-in policies at creation time. In this scenario, a policy can be configured with a 'deny' effect to automatically block any resource deployment that lacks the required 'CostCenter' tag, preventing non-compliant resources from being created without manual intervention.

Exam trap

The trap here is that candidates confuse Azure Policy's enforcement capabilities with Azure Blueprints' packaging role or RBAC's access control, mistakenly thinking Blueprints or RBAC can evaluate resource properties like tags at creation time.

How to eliminate wrong answers

Option B is wrong because Azure Blueprints is a declarative orchestration tool that packages together Azure Policy definitions, RBAC assignments, and resource templates for consistent environment setup, but it does not itself enforce real-time tag requirements during resource creation; it relies on included policies for enforcement. Option C is wrong because Azure Role-Based Access Control (RBAC) manages permissions and access to Azure resources based on roles (e.g., Contributor, Owner), but it cannot evaluate or enforce resource properties like tags at creation time; RBAC controls who can create resources, not what tags those resources must have.

Practice this question →

252

MCQhard

A company wants to ensure a specific resource group cannot be deleted, but they also need to be able to delete it temporarily during maintenance windows. Which approach allows the most granular control?

A.Assign an Azure Policy with deny effect on delete operations.

B.Apply a 'CanNotDelete' resource lock and remove it before maintenance.

C.Use Azure RBAC with a custom role that denies delete.

D.Use Azure Blueprints to enforce protection.

AnswerB

Resource locks can be easily removed and reapplied, offering flexible control.

Why this answer

A 'CanNotDelete' resource lock prevents deletion of a resource group and its resources, but it can be removed and reapplied as needed, providing granular control during maintenance windows. This approach allows temporary deletion by removing the lock, performing the deletion, and then reapplying the lock afterward. It is the only option that directly supports the requirement for both protection and temporary removal without permanent configuration changes.

Exam trap

The trap here is that candidates often confuse Azure Policy with resource locks, thinking Policy can block deletion, but Policy is for compliance auditing and enforcement of resource configurations, not for operational locks that directly prevent deletion actions.

How to eliminate wrong answers

Option A is wrong because Azure Policy with deny effect on delete operations is not designed to block resource group deletion; policies evaluate and enforce compliance rules on resource properties, but they do not prevent deletion actions at the resource group level. Option C is wrong because Azure RBAC with a custom role that denies delete would require modifying role assignments for each maintenance window, which is less granular and more cumbersome than a resource lock that can be toggled directly on the resource group. Option D is wrong because Azure Blueprints enforce governance and compliance by deploying resources and policies, but they do not provide a mechanism to temporarily allow deletion of a resource group; they are for environment setup, not operational control.

Practice this question →

253

MCQmedium

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

A.Azure Policy with the 'Inherit a tag from the resource group if missing' effect

B.Azure Resource Graph

C.Azure Management Groups

D.Azure Tags (manual tagging feature)

AnswerA

Correct. Azure Policy includes built-in effects (e.g., modify, append) that can automatically apply or inherit tags. The 'Inherit a tag from the resource group if missing' effect copies the resource group's tag value to resources that do not already have that tag, ensuring automatic compliance.

Why this answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces rules) with Azure Tags (which are just metadata) or Azure Resource Graph (which only queries), leading them to pick a manual or non-enforcing option.

How to eliminate wrong answers

Option B (Azure Resource Graph) is wrong because it is a query service for exploring resources, not an enforcement mechanism; it cannot automatically assign tags. Option C (Azure Management Groups) is wrong because they provide hierarchical organization for managing access, policies, and compliance across multiple subscriptions, but they do not directly inherit or apply tags to resources. Option D (Azure Tags manual tagging feature) is wrong because it requires users to manually apply tags, which contradicts the requirement to avoid relying on users.

Practice this question →

254

MCQeasy

Which Azure pricing calculator helps you estimate monthly costs for Azure services before deploying them?

A.Azure TCO Calculator

B.Azure Pricing Calculator

C.Azure Cost Management

D.Azure Advisor

AnswerB

The Azure Pricing Calculator lets you estimate monthly costs for any Azure service before deployment, supporting budget planning.

Why this answer

The Azure Pricing Calculator is the correct tool for estimating monthly costs of Azure services before deployment. It allows you to configure services (e.g., VMs, storage, databases) by specifying parameters like region, tier, and usage hours, then generates a detailed cost estimate. This pre-deployment estimation is its primary purpose, distinguishing it from post-deployment cost analysis tools.

Exam trap

The trap here is confusing the Azure Pricing Calculator (pre-deployment estimation) with the Azure TCO Calculator (on-premises vs. cloud comparison) or Azure Cost Management (post-deployment monitoring), as all three involve cost but serve different lifecycle stages.

How to eliminate wrong answers

Option A is wrong because the Azure TCO Calculator compares on-premises infrastructure costs with Azure cloud costs, not monthly service estimates for new deployments. Option C is wrong because Azure Cost Management analyzes and optimizes costs of already deployed resources, not pre-deployment estimation. Option D is wrong because Azure Advisor provides best-practice recommendations for existing resources (e.g., high availability, security), not cost estimation for planned services.

Practice this question →

255

MCQeasy

A company wants to track and analyze Azure costs across multiple departments. They have tagged resources with 'Department' tags. Which tool should they use to view cost breakdowns by department?

A.Azure Policy

B.Azure Cost Management + Billing

C.Azure Advisor

D.Azure Service Health

AnswerB

This tool provides cost analysis and reporting, including the ability to group costs by resource tags.

Why this answer

Azure Cost Management + Billing is the correct tool because it provides native capabilities to analyze and visualize Azure spending, including the ability to filter and group costs by custom tags such as 'Department'. This allows the company to break down costs per department without needing additional configuration or external tools.

Exam trap

The trap here is that candidates often confuse Azure Policy's ability to enforce tagging with the ability to analyze costs by those tags, but Azure Policy does not provide any cost reporting or analytics functionality.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool used to enforce rules and compliance on resources (e.g., requiring specific tags), but it does not provide cost analysis or breakdowns by tags. Option C is wrong because Azure Advisor offers recommendations for cost optimization, security, and performance, but it does not allow users to view or filter cost breakdowns by department tags.

Practice this question →

256

MCQmedium

A company needs to track and optimize costs across multiple Azure subscriptions. They want to allocate budgets and receive notifications when spending exceeds forecasted amounts. Which Azure tool should they use?

A.Azure Advisor

B.Azure Cost Management

C.Azure Policy

D.Azure Budgets

AnswerB

Cost Management allows you to create budgets, monitor spending, and configure alerts when costs exceed thresholds.

Why this answer

Azure Cost Management is the correct tool because it provides native capabilities to track, analyze, and optimize cloud costs across multiple subscriptions. It allows you to set budgets, configure cost alerts, and receive notifications when actual or forecasted spending exceeds defined thresholds, directly addressing the requirement for budget allocation and proactive spending notifications.

Exam trap

The trap here is that candidates often confuse Azure Advisor's cost recommendations (which suggest ways to save money) with the actual cost management and alerting capabilities of Azure Cost Management, leading them to select Advisor instead.

How to eliminate wrong answers

Option A is wrong because Azure Advisor is a personalized recommendation engine that provides best-practice guidance on reliability, security, performance, and cost optimization, but it does not allow you to set budgets or configure spending alerts. Option C is wrong because Azure Policy is a governance tool used to enforce organizational rules and compliance by applying policies to resources (e.g., restricting resource types or locations), not for tracking or optimizing costs or sending budget notifications.

Practice this question →

257

MCQmedium

A company wants to track costs by department across multiple Azure subscriptions. They have tagged resources with 'Department' tags. However, some resources are missing tags. They want to see a report of costs grouped by department, including untagged resources. Which Azure tool should they use?

A.Azure Cost Management + Billing

B.Azure Policy

C.Azure Resource Graph

D.Azure Advisor

AnswerA

Cost Management can analyze costs by tags and includes untagged resources in reports.

Why this answer

Azure Cost Management + Billing provides native cost analysis and reporting capabilities that can group costs by custom tags (like 'Department') and includes an 'Untagged' category for resources missing the specified tag. This allows the company to see a complete cost breakdown by department, including untagged resources, across multiple subscriptions in a single view.

Exam trap

The trap here is confusing Azure Policy's ability to enforce tagging (which ensures tags exist) with Cost Management's ability to report on existing tags, leading candidates to incorrectly select Azure Policy for cost reporting needs.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because it is a governance tool for enforcing compliance rules (e.g., requiring tags on new resources) and cannot generate cost reports or show historical cost data grouped by tags. Option C (Azure Resource Graph) is wrong because it is a query engine for exploring and discovering Azure resources based on properties, but it does not provide cost data or cost aggregation by tags. Option D (Azure Advisor) is wrong because it is a personalized recommendation engine for best practices in cost, security, reliability, and performance, not a tool for generating cost reports grouped by tags.

Practice this question →

258

MCQmedium

A company wants to deploy a standardized environment that includes Azure Policy assignments, RBAC roles, and resource group templates. They need to version these components and apply them to multiple subscriptions. Which Azure service should they use?

A.Azure Policy

B.Azure Blueprints

C.Azure Resource Manager

D.Azure Management Groups

AnswerB

Azure Blueprints allows you to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates in a versioned, repeatable manner.

Why this answer

Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a standardized environment by packaging Azure Policy assignments, RBAC roles, and resource group templates into a single, versioned, and repeatable artifact. It allows you to assign these components to multiple subscriptions while maintaining a consistent configuration and tracking changes through versioning.

Exam trap

The trap here is that candidates often confuse Azure Policy with Azure Blueprints, thinking that Policy alone can deploy and version a full environment, but Policy only enforces rules on existing resources and cannot orchestrate the deployment of RBAC roles and resource group templates as a single versioned artifact.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a service for enforcing rules and compliance on existing resources, but it cannot package multiple components like RBAC roles and resource group templates into a versioned artifact for deployment across subscriptions. Option C is wrong because Azure Resource Manager (ARM) is the underlying deployment and management service for Azure resources, but it does not provide a built-in mechanism to version and orchestrate a collection of policies, roles, and templates as a single blueprint. Option D is wrong because Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying governance at scale, but they do not directly deploy or version resource group templates, RBAC roles, or policy assignments as a cohesive unit.

Practice this question →

259

MCQmedium

A company has deployed hundreds of virtual machines in Azure across multiple subscriptions. The governance team wants to generate a compliance report that identifies which VMs are using approved VM sizes and which are not, according to a corporate policy. The team must not block the deployment of non-compliant VMs; they only want to track compliance. Which Azure Policy effect should they use in the policy definition?

A.Deny

B.Audit

C.Append

D.DeployIfNotExists

AnswerB

The Audit effect logs a compliance event in the activity log and marks the resource as non-compliant, but does not block deployment. This allows the team to generate a compliance report without interfering with existing deployments.

Why this answer

The Audit effect is the correct choice because it enables the governance team to log non-compliant resources (such as VMs using unapproved sizes) in the Azure Activity Log without blocking their deployment. This effect generates a compliance report while allowing the deployment to proceed, exactly matching the requirement to track compliance without enforcement.

Exam trap

The trap here is that candidates often confuse Audit with Deny, assuming that compliance tracking requires blocking non-compliant resources, but Azure Policy separates auditing (logging) from enforcement (denying) to allow flexible governance scenarios.

How to eliminate wrong answers

Option A is wrong because the Deny effect actively blocks the deployment of non-compliant resources, which contradicts the requirement that the team must not block deployment. Option C is wrong because the Append effect adds additional fields or tags to a resource during creation or update, but it does not generate compliance reports or track non-compliant VMs; it is used to enforce tagging policies, not to audit existing configurations.

Practice this question →

260

MCQmedium

A company has multiple Azure subscriptions for different departments. The governance team needs to ensure that every new subscription is automatically provisioned with a consistent set of resources, including a predefined network topology, mandatory Azure Policy assignments (e.g., allowed locations), and specific role-based access control (RBAC) assignments for the security team. The solution must be repeatable, version-controlled, and allow the team to update the defined artifacts and apply updates to existing subscriptions. Which Azure service should the team use to define and deploy this collection of governance artifacts?

A.Azure Blueprints

B.Azure Policy

C.Azure Management Groups

D.Azure Resource Manager templates

AnswerA

Azure Blueprints enables the orchestrated deployment of a collection of Azure artifacts (policies, role assignments, ARM templates, resource groups) in a versioned, repeatable manner. It is the correct service for defining and applying a consistent governance baseline across subscriptions.

Why this answer

Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable set of Azure resources, policies, and RBAC assignments as a single, version-controlled artifact. Unlike Azure Policy alone, Blueprints can include resource templates (e.g., network topology) and RBAC assignments, and it supports updating existing subscriptions by publishing new versions of the blueprint and assigning them to subscriptions.

Exam trap

The trap here is that candidates confuse Azure Policy (which only enforces rules) with Azure Blueprints (which orchestrates the deployment of policies, RBAC, and resources together), or they assume Management Groups can deploy resources when they only provide hierarchical management and policy inheritance.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because Azure Policy only enforces rules and effects on existing resources (e.g., allowed locations) but cannot deploy resources like a predefined network topology or assign RBAC roles; it lacks the ability to orchestrate resource creation. Option C (Azure Management Groups) is wrong because Management Groups provide a hierarchical structure for organizing subscriptions and applying policies or RBAC at scale, but they cannot define or deploy a collection of artifacts like network topologies or version-controlled blueprints; they are a management container, not a deployment tool.

Practice this question →

261

MCQmedium

A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?

A.Assign each policy definition individually to every subscription.

B.Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.

C.Create a single resource group at the tenant root level and assign the policy definitions to that resource group.

D.Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.

AnswerB

Management groups allow policy assignment at the group level. Subscriptions inside the group automatically inherit the assigned policies, including future subscriptions placed in that management group. This minimizes administrative overhead.

Why this answer

Option B is correct because management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.

Exam trap

The trap here is that candidates often confuse management groups with resource groups or Azure Blueprints, thinking that resource groups can span subscriptions or that Blueprints are required for policy inheritance, when in fact management groups provide the simplest and most scalable inheritance mechanism for policy assignments across multiple subscriptions.

How to eliminate wrong answers

Option A is wrong because assigning each policy definition individually to every subscription creates significant administrative overhead and does not automatically apply policies to future subscriptions, requiring manual re-assignment for each new subscription. Option C is wrong because a resource group at the tenant root level does not exist; Azure Policy assignments can be scoped to management groups, subscriptions, or resource groups, but the tenant root is a management group, not a resource group, and assigning policies to a single resource group would not cover all subscriptions across business units. Option D is wrong because Azure Blueprints can deploy new subscriptions with policies, but manually moving existing subscriptions into a blueprint's management group is not a scalable or automated approach; management groups themselves provide inheritance without the need for blueprint orchestration for this specific goal.

Practice this question →

262

MCQmedium

A company runs multiple projects in Azure, each project is placed in a separate resource group. The finance team wants to set a monthly spending limit of $10,000 per project and receive automated email alerts when a project's spending reaches 80% of the limit and again when it exceeds the limit. The solution must use native Azure capabilities and be configurable per resource group. Which Azure service should the finance team use?

A.Azure Policy with a built-in policy definition to enforce spending limits

B.Azure Cost Management budgets with alert rules

C.Azure Advisor cost recommendations

D.Azure Resource Graph queries triggered by Azure Automation runbooks on a schedule

AnswerB

Azure Cost Management allows you to create budgets with a defined amount (e.g., $10,000) and set alert thresholds (e.g., 80% and 100%). Alerts can automatically send email notifications to specified recipients. Budgets can be scoped to resource groups, making them suitable for per-project tracking.

Why this answer

Azure Cost Management budgets allow you to set spending limits at the scope of a resource group and configure alert rules that trigger automated email notifications when costs reach a specified threshold (e.g., 80% of the budget) and again when the limit is exceeded. This meets all requirements natively without additional automation or custom scripting.

Exam trap

The trap here is that candidates confuse Azure Policy (which enforces governance rules on resource properties) with Azure Cost Management budgets (which handle financial thresholds and alerts), leading them to select Policy because it sounds like a 'limit' enforcement tool.

How to eliminate wrong answers

Option A is wrong because Azure Policy is used to enforce compliance rules on resource configurations (e.g., allowed locations, SKU sizes), not to set or enforce monetary spending limits; it cannot trigger cost-based alerts. Option C is wrong because Azure Advisor provides cost optimization recommendations (e.g., right-sizing VMs, reserved instances) but does not allow you to set per-resource-group spending limits or send threshold-based alerts. Option D is wrong because Azure Resource Graph queries can retrieve cost data but require custom Azure Automation runbooks and scheduling to implement alerting, which is not a native, built-in capability for budget alerts and adds unnecessary complexity.

Practice this question →

263

MCQmedium

Which Azure pricing model allows customers to pay less per hour by committing to a 1-year or 3-year term for Azure services like VMs and SQL Database?

A.Pay-as-you-go

B.Azure Reservations

C.Azure Spot pricing

D.Azure Dev/Test pricing

AnswerB

Azure Reservations offer up to 72% discount for 1 or 3-year commitments on VMs, SQL Database, Cosmos DB, and other services.

Why this answer

Azure Reservations (also known as Reserved Instances) allow customers to commit to a 1-year or 3-year term for specific Azure services, such as VMs and SQL Database, in exchange for a significant discount (up to 72%) on the pay-as-you-go hourly rate. This pricing model is ideal for workloads with predictable usage, as the upfront commitment lowers the per-hour cost compared to on-demand pricing.

Exam trap

The trap here is that candidates often confuse Azure Reservations with Pay-as-you-go, thinking that any discount requires a long-term commitment, but Pay-as-you-go has no commitment and charges the highest per-hour rate, while Reservations specifically require a 1- or 3-year term for the discount.

How to eliminate wrong answers

Option A is wrong because Pay-as-you-go is a flexible pricing model with no upfront commitment, charging per hour or per second at the standard rate, which is higher than reserved pricing. Option C is wrong because Azure Spot pricing offers deep discounts on unused Azure capacity but does not involve a 1-year or 3-year commitment; instead, it can be evicted with short notice when capacity is needed elsewhere. Option D is wrong because Azure Dev/Test pricing provides discounted rates for development and testing workloads, but it does not require a 1-year or 3-year term commitment; it is based on a subscription benefit for non-production environments.

Practice this question →

264

MCQeasy

A company needs to ensure that all Azure resources have a mandatory 'CostCenter' tag. If a resource is created without this tag, the resource creation should be blocked. Which Azure Policy effect should they use?

A.Append

B.Deny

C.Audit

D.DeployIfNotExists

AnswerB

Deny prevents the creation of a resource that does not meet the policy condition, effectively blocking it.

Why this answer

The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule, such as missing the mandatory 'CostCenter' tag. This ensures that non-compliant resources are never provisioned, enforcing governance at the point of creation.

Exam trap

The trap here is that candidates often confuse 'Deny' with 'Append' because both can enforce tags, but Append only adds the tag after creation and does not block the resource if the tag is missing, failing the requirement to block creation entirely.

How to eliminate wrong answers

Option A is wrong because the Append effect adds the missing tag automatically rather than blocking the creation, which does not enforce the requirement that the user must specify the tag. Option C is wrong because the Audit effect only logs non-compliant resources without preventing their creation, allowing untagged resources to exist and requiring manual remediation.

Practice this question →

265

Drag & Dropmedium

Sequence the steps to deploy a virtual network (VNet) with subnets in Azure.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

VNet deployment requires portal access, address space, subnets, DNS, and final creation.

Practice this question →

266

MCQmedium

A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?

A.Deny

B.Audit

C.Append

D.Disabled

AnswerA

Deny prevents the resource creation and can display a user-defined error message explaining the approval process.

Why this answer

The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.

Exam trap

The trap here is that candidates often confuse the Deny effect with the Audit effect, mistakenly thinking that logging violations is sufficient to block actions, but Azure Policy's Audit effect does not prevent resource creation—it only records the event for later review.

How to eliminate wrong answers

Option B (Audit) is wrong because it only logs the VM creation attempt to the activity log without blocking it, so the VM would still be created, which does not meet the requirement to block all VM creation. Option C (Append) is wrong because it adds additional fields or tags to the resource during creation but does not block the creation itself, so VMs could still be provisioned without approval. Option D (Disabled) is wrong because it means the policy effect is not enforced at all, effectively disabling the policy and allowing VM creation without any restriction or notification.

Practice this question →

267

MCQmedium

A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?

A.Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.

B.Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.

C.Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.

D.Assign the 'Network Contributor' role to the security group at the root management group scope.

AnswerB

Role assignments at the management group scope are inherited by all subscriptions within that management group. This single assignment covers all current subscriptions and automatically applies to any new subscriptions added under the 'Production' management group, making it the most efficient method.

Why this answer

Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.

Exam trap

The trap here is that candidates may confuse Azure Policy with Azure RBAC, thinking Policy can assign roles, when in fact Policy only evaluates and enforces compliance rules, while role assignments must be done through Azure RBAC at the appropriate scope.

How to eliminate wrong answers

Option A is wrong because it requires manually assigning the role to each existing subscription individually and does not automatically apply to new subscriptions, which violates the requirement for future subscriptions and is inefficient. Option C is wrong because Azure Policy is used to enforce compliance rules (e.g., auditing or denying configurations), not to assign Azure RBAC roles; role assignments are managed through Azure RBAC, not Azure Policy, and attempting to use Policy for this purpose would be technically incorrect and unsupported.

Practice this question →

268

MCQeasy

What is the difference between the Azure portal and Azure CLI?

A.Azure portal is for production; Azure CLI is only for development

B.Azure portal is a web GUI; Azure CLI is a command-line scripting tool

C.Azure portal only works on Windows; Azure CLI works cross-platform

D.Azure portal manages resources; Azure CLI only deploys applications

AnswerB

Azure portal provides a graphical interface; Azure CLI provides command-line access enabling automation and scripting.

Why this answer

Option B is correct because the Azure portal is a web-based graphical user interface (GUI) for managing Azure resources through a browser, while Azure CLI is a cross-platform command-line tool that allows you to script and automate resource management using commands. Both tools can be used for production and development tasks, and they both manage resources—just through different interaction methods.

Exam trap

The trap here is that candidates often confuse the interface type (GUI vs. CLI) with functional limitations, assuming one is only for development or only for deployment, when in fact both tools provide full management capabilities across all environments.

How to eliminate wrong answers

Option A is wrong because both the Azure portal and Azure CLI are fully supported for production and development workloads; Azure CLI is not limited to development only. Option C is wrong because the Azure portal works on any modern browser regardless of the operating system (Windows, macOS, Linux), and Azure CLI is also cross-platform. Option D is wrong because Azure CLI can manage all Azure resources (create, update, delete, configure), not just deploy applications; both tools provide full resource management capabilities.

Practice this question →

269

MCQmedium

Which Azure cost optimization practice involves analyzing resource usage and removing or resizing underutilized resources?

A.Reserved Instance purchasing

B.Right-sizing underutilized resources

C.Enabling geo-redundant storage

D.Using Premium SSD disks for all workloads

AnswerB

Right-sizing analyzes usage and resizes overprovisioned resources to their actual needed capacity.

Why this answer

Right-sizing underutilized resources is a core Azure cost optimization practice that involves analyzing resource usage metrics (e.g., CPU, memory, disk I/O) and then either resizing to a smaller SKU or deallocating idle resources. This directly reduces compute, storage, and licensing costs by aligning capacity with actual demand, as opposed to paying for over-provisioned capacity.

Exam trap

The trap here is that candidates confuse 'right-sizing' with 'Reserved Instances' because both reduce costs, but Reserved Instances are a commitment-based discount model, not an analysis-driven resizing practice.

How to eliminate wrong answers

Option A is wrong because Reserved Instance purchasing is a cost-saving commitment model (1- or 3-year term) that reduces per-hour rates, but it does not involve analyzing or removing underutilized resources; it assumes you already know the required capacity. Option C is wrong because enabling geo-redundant storage (GRS) increases cost by replicating data to a secondary region for disaster recovery, which is a resilience practice, not a cost optimization practice. Option D is wrong because using Premium SSD disks for all workloads is an anti-pattern for cost optimization; Premium SSDs are designed for high-performance I/O workloads, and using them for low-IOPS workloads (e.g., archival or dev/test) unnecessarily increases storage costs.

Practice this question →

270

MCQmedium

Which Azure feature automatically moves blob data between access tiers based on defined rules to optimize storage costs?

A.Azure Storage Explorer

B.Azure Blob Storage lifecycle management policies

C.Azure Intelligent-Tiering

D.Azure Cost Management auto-optimization

AnswerB

Lifecycle policies automatically transition blobs between Hot, Cool, and Archive tiers based on age or access rules.

Why this answer

Azure Blob Storage lifecycle management policies allow you to define rules that automatically move blob data between access tiers (hot, cool, cold, archive) or delete data based on age or last modification time. This reduces storage costs by ensuring data is stored in the most cost-effective tier without manual intervention.

Exam trap

The trap here is that candidates confuse Azure's blob lifecycle management with AWS S3 Intelligent-Tiering (Option C), or assume Cost Management can perform automated tier moves, when in fact only lifecycle policies provide rule-based, automated tier transitions for blobs.

How to eliminate wrong answers

Option A is wrong because Azure Storage Explorer is a graphical tool for managing storage accounts and blobs, not an automated policy engine for tier transitions. Option C is wrong because Azure Intelligent-Tiering is a feature of AWS S3, not Azure; Azure's equivalent is the 'hot/cool/archive' tiering with lifecycle management. Option D is wrong because Azure Cost Management provides cost analysis and budgeting recommendations but does not automatically move blob data between tiers; it lacks the rule-based execution engine for storage tier transitions.

Practice this question →

271

MCQmedium

A multinational company has 10 Azure subscriptions, each managed by a different department. The central governance team wants to deploy a standardized environment that includes a specific network topology (virtual network, subnets, and network security groups), a set of Azure Policy definitions to enforce tagging and encryption, and a role assignment granting the 'Reader' role to a central security team in every subscription. The team must be able to update this standard definition in one place, and any changes should automatically apply to all existing deployments that were created from the definition. Which Azure service should they use?

A.Azure Policy

B.Azure Blueprints

C.Azure Resource Manager (ARM) templates

D.Azure Management Groups

AnswerB

Azure Blueprints allows you to define a repeatable set of Azure resources, policies, role assignments, and more. Blueprints can be deployed to multiple subscriptions, and when the blueprint definition is updated, existing assignments can be upgraded to apply the changes automatically. This meets all the requirements: consistent deployment, central updates, and automatic propagation.

Why this answer

Azure Blueprints is the correct choice because it enables the central governance team to define a repeatable, versioned environment that includes network topology, Azure Policy definitions, and role assignments. Blueprints support versioning and automatic updates: when a blueprint is updated and published, existing blueprint assignments can be upgraded to apply the new definitions to all deployed resources, ensuring consistency across all 10 subscriptions.

Exam trap

The trap here is that candidates confuse Azure Blueprints with ARM templates or Azure Policy, not realizing that Blueprints uniquely combine infrastructure deployment, policy enforcement, and role assignments in a versioned, upgradeable package that automatically propagates updates to existing deployments.

How to eliminate wrong answers

Option A (Azure Policy) is wrong because while it enforces tagging and encryption rules, it cannot deploy network topology (VNet, subnets, NSGs) or assign roles; it only audits or enforces compliance on existing resources. Option C (ARM templates) is wrong because they are idempotent deployment files but lack built-in versioning and automatic update propagation to existing deployments; updating a template requires redeployment to each subscription individually. Option D (Azure Management Groups) is wrong because they provide hierarchical management for organizing subscriptions and applying policies at scale, but they cannot deploy infrastructure or assign roles directly to resources; they are a governance container, not a deployment artifact.

Practice this question →

272

MCQmedium

A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?

A.An Azure Blueprint containing the policy definitions

B.An Azure Policy initiative (policy set definition) containing the policy definitions

C.An Azure Policy assignment for each individual definition at the root management group

D.An Azure Resource Manager template that deploys the policy definitions

AnswerB

An Azure Policy initiative (policy set definition) is designed specifically to group multiple policy definitions into a single, assignable unit. Assigning the initiative to the appropriate management group or subscription applies all included policies at once, simplifying management and enabling consolidated compliance reporting.

Why this answer

An Azure Policy initiative (policy set definition) allows grouping multiple individual policy definitions into a single set, which can then be assigned as one entity. This simplifies management and ensures consistent compliance across all subscriptions, as the security team requires. Assigning the initiative at the root management group applies it to all 15 subscriptions under the management groups.

Exam trap

The trap here is that candidates confuse Azure Blueprints with Policy initiatives, thinking Blueprints are the correct way to group policies, but Blueprints are for full environment deployment and versioning, not for simply grouping policy definitions for assignment.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints are used for orchestrating the deployment of resource templates, policies, and role assignments as a package for creating consistent environments, but they are not the native mechanism for grouping policy definitions into a single assignable entity; Blueprints include policies but are more about environment composition and versioning, not just policy grouping. Option C is wrong because assigning each individual policy definition separately at the root management group would create 8 separate assignments, which contradicts the requirement to 'assign these policies as a single entity to simplify management' and increases administrative overhead. Option D is wrong because an Azure Resource Manager template can deploy policy definitions and assignments, but it does not create a reusable, centrally manageable group of policies; it is a deployment artifact, not a management grouping construct like an initiative.

Practice this question →

273

MCQmedium

A company has multiple subscriptions. They want to apply a policy that denies creation of resources without a specific tag at the top-level management group. Later, they need to allow a specific subscription to create resources without that tag. What should they do?

A.Assign a different policy at the subscription level that allows untagged resources.

B.Create an exclusion for that subscription in the policy assignment.

C.Modify the top-level policy to include an exemption.

D.Remove the subscription from the management group.

AnswerB

Exclusions in Azure Policy allow you to exempt a child scope from the policy effect.

Why this answer

Azure Policy allows you to assign policies at the management group scope, which applies to all child subscriptions. When you need to exempt a specific subscription from a policy effect (like 'Deny'), you can configure an exclusion on the policy assignment at the management group level. This exclusion removes the policy evaluation for that subscription, allowing resources to be created without the required tag.

Exam trap

The trap here is confusing 'exclusion' (which removes a scope from policy evaluation) with 'exemption' (which marks a resource as compliant despite non-compliance) or thinking a lower-level policy assignment can override a higher-level 'Deny' effect.

How to eliminate wrong answers

Option A is wrong because a policy assignment at the subscription level cannot override a 'Deny' effect from a higher-level management group assignment; policy evaluation is cumulative and the most restrictive effect applies. Option C is wrong because an exemption is used to waive compliance for a specific resource or scope, but it does not change the policy's enforcement behavior; exclusions are the correct mechanism to skip evaluation entirely. Option D is wrong because removing the subscription from the management group would break the hierarchical governance structure and could affect other policies or RBAC assignments; it is an overly drastic and incorrect approach.

Practice this question →

274

MCQhard

Which Azure feature helps organizations maintain compliance by managing and auditing privileged access to Azure resources using just-in-time access?

A.Azure RBAC

B.Azure AD Conditional Access

C.Azure AD Privileged Identity Management (PIM)

D.Azure Key Vault

AnswerC

PIM provides just-in-time privileged access with approval workflows, time limits, and audit logs.

Why this answer

Azure AD Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, enabling organizations to grant time-bound, approval-based roles that reduce standing admin privileges. PIM also generates audit logs for all activations and deactivations, directly supporting compliance requirements by ensuring privileged access is managed and auditable.

Exam trap

The trap here is confusing Azure RBAC (which defines what permissions are possible) with PIM (which controls when and how those permissions are activated), leading candidates to pick Azure RBAC because it is associated with roles, even though it lacks the JIT and auditing features required by the question.

How to eliminate wrong answers

Option A is wrong because Azure RBAC (Role-Based Access Control) is a static authorization model that assigns permanent roles to users or groups; it does not provide just-in-time access or time-bound activation. Option B is wrong because Azure AD Conditional Access enforces policies based on signals like location or device compliance at sign-in, but it does not manage or audit privileged role activation or JIT access to Azure resources. Option D is wrong because Azure Key Vault is a secrets management service for storing keys, certificates, and passwords; it does not handle privileged identity management or JIT access controls.

Practice this question →

275

MCQmedium

A company has three departments: Sales, Marketing, and IT. Each department has its own Azure subscription. The IT department manages all networking and security policies across all subscriptions. The Sales and Marketing departments should be able to create and manage their own resources but cannot modify networking or security policies. The IT department wants to apply a consistent set of policies (e.g., enforce tagging, restrict VM SKUs) across all subscriptions without needing to assign policies to each subscription individually. Additionally, the IT department wants to delegate administration of a specific custom role to a junior administrator who can assign that role to users within the Sales subscription only. Which combination of Azure governance features should the IT department use?

A.Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.

B.Create a management group for each department, assign Azure Policy initiatives at each management group, and use Azure Blueprints to manage role assignments.

C.Use Azure Resource Manager templates to deploy policies and role assignments to each subscription, and use Azure Active Directory administrative units to manage delegation.

D.Assign Azure Policy initiatives to each subscription individually, and create a custom role that is scoped to the management group.

AnswerA

Correct. Management groups allow applying policies to all child subscriptions with a single assignment. RBAC custom roles can be scoped to a specific subscription, enabling delegated administration for only that subscription.

Why this answer

Option A is correct because Azure management groups allow hierarchical policy inheritance: assigning an Azure Policy initiative at the management group level automatically applies it to all child subscriptions (Sales, Marketing, IT). This satisfies the requirement for consistent policies without individual assignment. Additionally, Azure RBAC with a custom role scoped to the Sales subscription enables the IT department to delegate administration of that role to a junior administrator, who can then assign it only within the Sales subscription, meeting the delegation requirement precisely.

Exam trap

The trap here is that candidates often confuse management groups with resource groups or assume that Azure Blueprints (Option B) are required for policy inheritance, when in fact management groups alone provide the necessary hierarchical policy assignment and RBAC scoping.

How to eliminate wrong answers

Option B is wrong because creating separate management groups for each department would require assigning policies to each management group individually, which contradicts the requirement to apply consistent policies across all subscriptions without individual assignment. Option C is wrong because Azure Resource Manager templates deploy resources but do not provide ongoing, centrally managed policy enforcement or delegation; Azure AD administrative units manage user and device administration, not Azure subscription-level role delegation. Option D is wrong because assigning Azure Policy initiatives to each subscription individually violates the requirement to avoid individual assignment, and scoping a custom role to the management group would grant the junior administrator permissions across all subscriptions, not just the Sales subscription.

Practice this question →

276

MCQmedium

Which Azure governance tool provides a way to audit all changes made to resources in your Azure subscription?

A.Azure Monitor Metrics

B.Azure Activity Log

C.Azure Application Insights

D.Azure Resource Health

AnswerB

Activity Log records all control plane operations (create, update, delete, RBAC changes) for auditing.

Why this answer

The Azure Activity Log is the correct tool because it provides a complete audit trail of all control-plane operations (management-plane actions) performed on resources in an Azure subscription. Every create, update, delete, and other write operation (PUT, POST, DELETE) is logged, enabling you to answer 'who, what, when, where, and how' for any change. This makes it the primary governance tool for auditing resource modifications.

Exam trap

The trap here is that candidates often confuse Azure Monitor Metrics (which tracks performance data) with the Activity Log (which tracks configuration changes), because both are part of Azure Monitor but serve fundamentally different purposes.

How to eliminate wrong answers

Option A is wrong because Azure Monitor Metrics collects numerical time-series data (e.g., CPU percentage, request count) for performance and health monitoring, not a log of resource configuration changes. Option C is wrong because Azure Application Insights is an application performance management (APM) service that monitors live web applications, tracking telemetry like page views and exceptions, not subscription-level resource audit events. Option D is wrong because Azure Resource Health provides a personalized dashboard of the current and past health status of your Azure resources, diagnosing service-level issues, not auditing changes made to resources.

Practice this question →

277

MCQmedium

A company wants to enforce that all Azure storage accounts must have encryption enabled. If a storage account is created without encryption, the policy should automatically enable encryption without manual intervention. Which Azure Policy effect should they use?

A.Modify

B.Deny

C.Audit

D.DeployIfNotExists

AnswerA

Correct. The Modify effect can change a resource property, such as enabling encryption, to remediate non-compliant resources.

Why this answer

The Modify effect is correct because it can automatically enable encryption on a storage account that does not have it enabled, without requiring manual intervention. Unlike DeployIfNotExists, which only deploys resources if they don't exist, Modify can alter existing properties (like encryption settings) on the resource itself. This ensures compliance by remediating non-compliant resources in real time or during evaluation cycles.

Exam trap

The trap here is confusing DeployIfNotExists with Modify: DeployIfNotExists deploys a new resource (like a diagnostic setting) but cannot change properties of the existing resource itself, whereas Modify directly alters the resource's configuration.

How to eliminate wrong answers

Option B (Deny) is wrong because it only blocks creation of a storage account without encryption, but does not automatically enable encryption on an existing account; it prevents the action but does not remediate. Option C (Audit) is wrong because it only logs whether encryption is enabled or not, without taking any automatic remediation action. Option D (DeployIfNotExists) is wrong because it deploys a new resource (e.g., a Log Analytics workspace) if one does not exist, but it cannot modify properties of an existing resource like enabling encryption on a storage account.

Practice this question →

278

MCQmedium

A company has multiple Azure subscriptions. The finance team needs to analyze spending trends and create budgets to prevent cost overruns. Which Azure tool should they use to visualize historical spending and set budget alerts?

A.Azure Advisor

B.Azure Cost Management + Billing

C.Azure Policy

D.Azure Monitor

AnswerB

This service offers detailed cost analysis, budget creation, and alert capabilities across subscriptions.

Why this answer

Azure Cost Management + Billing is the correct tool because it provides native capabilities for analyzing historical spending trends, creating budgets, and setting cost-based alerts. It integrates directly with Azure's billing data to visualize costs across subscriptions and resource groups, and its budget alerts can trigger actions (e.g., email notifications or automation runbooks) when spending exceeds defined thresholds.

Exam trap

The trap here is that candidates confuse Azure Advisor's cost recommendations (which suggest ways to save money) with the actual cost management and budgeting capabilities of Azure Cost Management + Billing, leading them to select Advisor instead.

How to eliminate wrong answers

Option A is wrong because Azure Advisor is a personalized recommendation engine that optimizes Azure resources for high availability, security, performance, and cost—but it does not provide historical spending visualization or budget alert creation. Option C is wrong because Azure Policy enforces organizational rules and compliance standards on resources (e.g., restricting VM SKUs) but does not analyze spending trends or set cost budgets. Option D is wrong because Azure Monitor collects and analyzes telemetry data (metrics, logs) for application and infrastructure performance, not financial cost data or budget alerts.

Practice this question →

279

MCQhard

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

A.A) audit and deny

B.B) audit and deployIfNotExists

C.C) append and deny

D.D) modify and audit

AnswerB

Audit logs non-compliant existing resources, and deployIfNotExists deploys a remediation task to enable secure transfer on new resources.

Why this answer

The correct combination is 'audit' and 'deployIfNotExists'. The 'audit' effect logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. The 'deployIfNotExists' effect automatically remediates new non-compliant storage accounts by enabling secure transfer (HTTPS) during deployment, enforcing the policy on new resources without blocking creation.

Exam trap

The trap here is that candidates confuse 'deny' (which blocks non-compliant resources) with 'deployIfNotExists' (which fixes them), and overlook that 'audit' is required for existing resources while 'deployIfNotExists' handles new ones.

How to eliminate wrong answers

Option A is wrong because 'deny' blocks creation of non-compliant resources, but the requirement is to automatically fix new accounts, not block them; also, 'deny' does not audit existing accounts. Option C is wrong because 'append' adds fields to a resource but cannot enable secure transfer (a boolean property) after creation; 'deny' again blocks instead of fixing. Option D is wrong because 'modify' can alter properties but does not audit existing accounts; 'audit' alone does not enforce or fix new accounts.

Practice this question →

280

MCQhard

A company needs to ensure that no resources in any subscription can be created without a specific cost center tag. Which Azure feature accomplishes this?

A.Azure Blueprints with tag templates

B.Azure RBAC with custom roles

C.Azure Policy with a 'require tag' definition in deny mode

D.Azure Resource Groups with tag inheritance

AnswerC

Azure Policy with 'Require a tag' in deny mode blocks all resource creation without the specified tag.

Why this answer

Azure Policy with a 'require tag' definition in deny mode is the correct choice because it enforces a rule that blocks the creation of any resource that does not include the specified cost center tag. Azure Policy evaluates resource creation requests against defined policies and can deny non-compliant requests before the resource is provisioned, ensuring governance at the subscription or management group level.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces rules) with Azure Blueprints (which packages resources and policies) or RBAC (which controls permissions), leading them to choose a governance tool that does not actually block non-compliant resource creation.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints with tag templates can define and assign tags to resources during deployment, but they do not enforce a deny action on resource creation; they are used for orchestration and compliance, not for blocking non-compliant resources. Option B is wrong because Azure RBAC with custom roles controls who can perform actions (authorization) but cannot enforce tag requirements on resources; RBAC does not evaluate resource properties like tags. Option D is wrong because Azure Resource Groups with tag inheritance allow tags to propagate from the resource group to its resources, but this is a default behavior that can be overridden and does not prevent creation of resources without the required tag.

Practice this question →

281

MCQhard

A company uses Azure Blueprints to define a standard environment for all new development subscriptions. The blueprint includes a set of Azure policies, role assignments, and resource templates. However, after applying the blueprint, some resources are created that do not comply with the policies. The company wants to be notified of these non-compliant resources without blocking their creation. Which Azure Policy effect should be used in the blueprint?

A.Audit

B.Deny

C.Append

D.DeployIfNotExists

AnswerA

Audit effect provides logging and notifications for non-compliance without denying the request.

Why this answer

The Audit effect is correct because it enables Azure Policy to evaluate resources against the defined policies and log compliance warnings in the activity log without blocking resource creation. This meets the requirement to be notified of non-compliant resources while allowing them to be created.

Exam trap

The trap here is that candidates often choose Deny because they assume compliance must be enforced, but the question explicitly requires non-blocking notification, making Audit the only effect that logs non-compliance without preventing resource creation.

How to eliminate wrong answers

Option B (Deny) is wrong because it blocks the creation or modification of non-compliant resources, which contradicts the requirement to allow creation. Option C (Append) is wrong because it adds additional fields or tags to a resource during creation or update to enforce compliance, but it does not generate notifications for non-compliance; it modifies the resource instead. Option D (DeployIfNotExists) is wrong because it triggers a deployment to remediate non-compliant resources after creation, but it does not provide a notification mechanism for non-compliance without blocking creation.

Practice this question →

282

MCQeasy

What is the Azure Well-Architected Framework?

A.A billing structure for Azure services

B.A set of architectural guiding principles for building reliable, secure, and efficient cloud workloads

C.A compliance certification program for Azure partners

D.A tool for migrating on-premises applications to Azure

AnswerB

The Well-Architected Framework provides 5-pillar guidance for building high-quality Azure workloads.

Why this answer

The Azure Well-Architected Framework is a set of five architectural pillars (Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency) that provide best practices and guiding principles for designing and operating reliable, secure, and efficient cloud workloads on Azure. It is not a billing structure, compliance program, or migration tool, but rather a prescriptive framework to help architects evaluate and improve their cloud architectures.

Exam trap

The trap here is that candidates often confuse the Well-Architected Framework with a specific Azure service or tool (like Azure Migrate or Azure Policy), when in fact it is a conceptual framework of best practices, not a deployable product.

How to eliminate wrong answers

Option A is wrong because the Azure Well-Architected Framework is not a billing structure; billing is managed through Azure Cost Management and the Azure pricing calculator, not through architectural guidance. Option C is wrong because it is not a compliance certification program; compliance certifications (e.g., ISO 27001, SOC 2) are separate programs offered by Microsoft, while the framework provides design principles to help meet compliance requirements. Option D is wrong because it is not a migration tool; Azure Migrate is the dedicated service for assessing and migrating on-premises applications to Azure, whereas the Well-Architected Framework guides the design of the target architecture post-migration.

Practice this question →

283

MCQhard

A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?

A.A) Azure Key Vault

B.B) Azure Policy

C.C) Azure Managed Identity

D.D) Azure Service Principal

AnswerA

Key Vault provides secure storage for secrets and can be referenced in ARM templates to pass sensitive values at deployment time.

Why this answer

Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.

Exam trap

The trap here is confusing Azure Key Vault with Azure Managed Identity or Service Principal, as candidates often think that Managed Identity or Service Principals are used to store secrets, when in fact they are identities that require secrets to be stored elsewhere, typically in Key Vault.

How to eliminate wrong answers

Option B is wrong because Azure Policy is a governance tool used to enforce organizational standards and compliance rules across resources, not to store or retrieve secrets. Option C is wrong because Azure Managed Identity provides an automatically managed identity in Azure AD for authenticating to services that support Azure AD authentication, but it does not store secrets; it is used to obtain tokens for accessing resources like Key Vault. Option D is wrong because an Azure Service Principal is a security identity used by applications or automation tools to authenticate to Azure resources, but it is not a secret storage service; it requires a client secret or certificate that would itself need to be stored securely, typically in Key Vault.

Practice this question →

284

MCQmedium

A large enterprise has multiple Azure subscriptions for different departments. The central IT team wants to enforce a policy that restricts the Azure regions where resources can be deployed. The policy must automatically apply to all existing subscriptions and to any new subscriptions created in the future, without requiring manual assignment to each subscription individually. Which Azure feature should the central IT team use to achieve this hierarchical governance?

A.Azure Management Groups

B.Azure Blueprints

C.Azure Resource Groups

D.Azure Policy alone assigned to each subscription

AnswerA

Correct. Management Groups allow you to assign Azure Policy at a high level (e.g., root management group) and have that policy automatically apply to all child subscriptions, including future subscriptions, ensuring consistent governance across the entire hierarchy.

Why this answer

Azure Management Groups provide a hierarchical structure above subscriptions, allowing policies (like region restrictions) to be assigned at the management group level. This inheritance ensures the policy automatically applies to all existing subscriptions within the group and to any new subscriptions added later, without manual per-subscription assignment.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces rules) with the hierarchical structure needed to apply those rules broadly; Azure Policy alone requires manual assignment, whereas Management Groups enable automatic inheritance across subscriptions.

How to eliminate wrong answers

Option B is wrong because Azure Blueprints are used for deploying and orchestrating a collection of resources (including policies, role assignments, and resource templates) as a repeatable package, but they do not provide ongoing automatic enforcement across all subscriptions without manual re-assignment. Option C is wrong because Azure Resource Groups are logical containers for resources within a single subscription and cannot enforce policies across multiple subscriptions or automatically apply to new subscriptions. Option D is wrong because assigning Azure Policy alone to each subscription requires manual assignment to every existing and future subscription, which does not meet the requirement for automatic, hierarchical governance across all subscriptions.

Practice this question →

285

MCQeasy

What does an Azure Service Level Agreement (SLA) define?

A.The maximum number of resources you can create in Azure

B.The pricing model for Azure services

C.Microsoft's uptime and connectivity commitments for Azure services

D.The geographic locations where services are available

AnswerC

SLAs define the guaranteed uptime percentage and service credit terms if the guarantee is not met.

Why this answer

An Azure Service Level Agreement (SLA) is a formal document from Microsoft that defines the uptime and connectivity guarantees for each Azure service. For example, a typical SLA for a virtual machine deployed across two availability zones promises 99.99% uptime, meaning Microsoft commits to a maximum of 52.56 minutes of downtime per year. If Microsoft fails to meet these commitments, customers may be eligible for service credits or a refund, making the SLA a critical component of Azure's governance and reliability framework.

Exam trap

The trap here is that candidates often confuse the SLA with service limits or pricing, but the SLA is exclusively about uptime and connectivity commitments, not resource caps or cost.

How to eliminate wrong answers

Option A is wrong because the maximum number of resources you can create in Azure is defined by Azure subscription and service limits (e.g., 980 resource groups per subscription), not by an SLA. Option B is wrong because the pricing model for Azure services is defined by the Azure Pricing Calculator and published pricing pages, not by an SLA. Option D is wrong because the geographic locations where services are available are defined by Azure region and availability zone documentation, not by an SLA.

Practice this question →

286

MCQmedium

A company uses Azure Policy to govern its Azure environment. The governance team wants to enforce that all virtual machines (VMs) deployed in the production subscription use only approved operating system images from a specific Azure Compute Gallery. However, during a transition period, the team does not want to block the creation of VMs that use non-approved images; instead, they need to identify and report on any non-compliant VMs. They also want to track compliance over time. Which Azure Policy effect should the governance team use in the policy definition to meet these requirements?

A.Deny

B.Audit

C.Append

D.Modify

AnswerB

The Audit effect evaluates resources for compliance and generates a warning event in the activity log, but does not block the resource operation. This allows the governance team to identify and report non-compliant VMs without interrupting the deployment process.

Why this answer

The Audit effect is correct because it enables the governance team to identify and report non-compliant VMs without blocking their creation. Azure Policy's Audit effect logs a warning in the activity log for resources that violate the policy, allowing the team to track compliance over time via Azure Policy compliance reports and Azure Monitor, while the transition period remains unblocked.

Exam trap

The trap here is that candidates often choose Deny because they assume governance requires enforcement, missing the explicit requirement to allow creation and only report non-compliance during the transition period.

How to eliminate wrong answers

Option A is wrong because Deny would block the creation of VMs using non-approved images, which contradicts the requirement to allow creation during the transition period. Option C is wrong because Append adds fields or tags to a resource during creation or update, but it does not report on non-compliant VMs or track compliance over time. Option D is wrong because Modify alters properties of existing resources (e.g., via a remediation task), but it does not provide reporting on non-compliant VMs without blocking creation.

Practice this question →

287

MCQmedium

Which Azure tool helps identify compliance issues by continuously evaluating your resource configurations against defined policies?

A.Azure Monitor

B.Azure Advisor

C.Azure Policy compliance dashboard

D.Azure Resource Graph

AnswerC

Azure Policy continuously evaluates resources and shows compliance state against defined policy rules.

Why this answer

Azure Policy compliance dashboard is the correct answer because it provides a centralized view of the compliance state of your Azure resources against the defined policy assignments. It continuously evaluates resource configurations and displays which resources are compliant or non-compliant, allowing you to identify and remediate compliance issues proactively.

Exam trap

The trap here is that candidates often confuse Azure Policy compliance dashboard with Azure Monitor or Azure Advisor, thinking that monitoring or advisory tools are responsible for compliance evaluation, but Azure Policy is the only service that enforces and reports on compliance against defined rules.

How to eliminate wrong answers

Option A is wrong because Azure Monitor is a monitoring and diagnostics service that collects and analyzes telemetry data (metrics, logs) from resources, but it does not evaluate resource configurations against defined policies. Option B is wrong because Azure Advisor provides personalized recommendations for best practices in cost, security, reliability, and performance, but it does not enforce or evaluate compliance against custom policy definitions. Option D is wrong because Azure Resource Graph is a query service that allows you to explore and discover resources across subscriptions using Kusto Query Language (KQL), but it does not continuously evaluate compliance or provide a compliance dashboard.

Practice this question →

288

MCQmedium

Which Azure security feature prevents accidental deletion of a critical production resource group?

A.Assigning Reader role to all users

B.Applying a CanNotDelete resource lock to the resource group

C.Setting an Azure Policy to deny resource group deletion

D.Enabling Azure Backup for the resource group

AnswerB

A CanNotDelete lock prevents deletion by any user until the lock is removed, regardless of RBAC permissions.

Why this answer

A CanNotDelete resource lock prevents any user or process from deleting the resource group, regardless of their permissions (including Owner). This is the correct mechanism to guard against accidental deletion of critical production resources because it overrides role-based access control (RBAC) permissions for delete operations.

Exam trap

The trap here is that candidates often confuse Azure Policy with resource locks, thinking Policy can block delete actions, but Policy only audits or enforces configuration compliance and cannot prevent resource group deletion.

How to eliminate wrong answers

Option A is wrong because assigning the Reader role only prevents users from making changes, but an administrator with Owner or Contributor rights could still delete the resource group; it does not protect against accidental deletion by authorized users. Option C is wrong because Azure Policy evaluates and enforces compliance rules on resource properties (e.g., allowed locations, tags), but it cannot directly block a delete operation on a resource group—Azure Policy does not intercept ARM DELETE calls. Option D is wrong because Azure Backup protects data by creating recovery points, but it does not prevent the resource group itself from being deleted; if the resource group is deleted, the backup vault and its data may also be lost.

Practice this question →

289

MCQmedium

A company has a policy that all Azure resources must have a 'CostCenter' tag. The governance team wants to identify any resources that are missing the tag without preventing their creation. They need a compliance report generated automatically showing all non-compliant resources. Which Azure Policy effect should they use?

A.deny

B.audit

C.deployIfNotExists

D.append

AnswerB

The 'audit' effect creates a compliance report entry in the activity log and marks the resource as non-compliant in policy compliance, but does not block the resource creation or modify it. This meets the requirement to identify missing tags without disrupting deployment.

Why this answer

The 'audit' effect is correct because it allows the company to monitor and report on resources that are missing the 'CostCenter' tag without blocking their creation. Azure Policy's audit effect logs a compliance event in the activity log for non-compliant resources, which can then be used to generate automatic compliance reports via Azure Policy's compliance dashboard or exported to Log Analytics. This meets the requirement of identifying non-compliant resources while not preventing their deployment.

Exam trap

The trap here is that candidates often confuse 'audit' with 'deny' or 'append' because they think tagging enforcement requires blocking or automatically adding tags, but the question explicitly states that resource creation must not be prevented, making 'audit' the only effect that purely reports without intervention.

How to eliminate wrong answers

Option A is wrong because 'deny' would block the creation of any resource missing the 'CostCenter' tag, which violates the requirement that resource creation must not be prevented. Option C is wrong because 'deployIfNotExists' is used to automatically remediate non-compliant resources by deploying a defined template (e.g., adding the tag), but the requirement is only to report non-compliance, not to fix it. Option D is wrong because 'append' would add the 'CostCenter' tag to resources during creation or update, which would prevent the resource from being created without the tag, again violating the requirement to allow creation without the tag.

Practice this question →

290

MCQmedium

What is a Service Principal in Azure Active Directory?

A.A special high-privilege user account for Azure administrators

B.An identity for applications and automated processes to access Azure resources

C.A role that grants full access to all Azure resources in a subscription

D.A security group for organizing users with similar access needs

AnswerB

Service Principals are Azure AD identities for non-human applications and automated services.

Why this answer

A Service Principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. It functions as a security principal that can be assigned roles (via Azure RBAC) to authenticate and authorize operations, enabling secure, programmatic access without requiring a user account.

Exam trap

The trap here is that candidates confuse a Service Principal with a user account or a role, failing to recognize it as a non-interactive identity for applications and automated processes that requires explicit role assignment to access resources.

How to eliminate wrong answers

Option A is wrong because a Service Principal is not a high-privilege user account; it is a non-interactive identity for applications, and its privileges are determined solely by assigned RBAC roles, not by default. Option C is wrong because a Service Principal does not inherently grant full access to all resources; it is an identity that must be explicitly assigned roles (e.g., Contributor or Owner) to access resources. Option D is wrong because a Service Principal is not a security group; it is a single identity for an application or service, whereas security groups are used to organize users and other principals for collective access management.

Practice this question →

291

MCQmedium

A company has multiple Azure subscriptions used by different departments. The governance team has created several Azure Policy definitions to enforce tagging rules, restrict allowed VM SKUs, and require HTTPS for storage accounts. The team wants to assign these policies as a single, manageable unit to a management group so that they can track overall compliance across all subscriptions in that group from one dashboard. The compliance summary should show how many resources are compliant against all the combined policies. Which Azure feature should the team use?

A.Azure Policy Initiative

B.Azure Role-Based Access Control (RBAC)

C.Azure Management Groups

D.Azure Resource Graph

AnswerA

An Azure Policy Initiative (policy set definition) groups multiple individual policy definitions into a single bundle for assignment. This allows the governance team to assign all the tagging, VM SKU, and HTTPS policies together and view the overall compliance status across the management group from a single dashboard. This is exactly the feature described.

Why this answer

Azure Policy Initiative is the correct choice because it allows the governance team to group multiple Azure Policy definitions (tagging rules, VM SKU restrictions, HTTPS requirement) into a single, manageable unit. Assigning this initiative to a management group enables aggregated compliance tracking across all subscriptions within that group, showing a unified compliance summary for all combined policies.

Exam trap

The trap here is that candidates confuse Azure Management Groups (the scope for assignment) with Azure Policy Initiatives (the grouping of policies), leading them to select Management Groups as the feature that provides the compliance summary, when in fact Management Groups only organize subscriptions and do not combine policies into a single compliance unit.

How to eliminate wrong answers

Option B is wrong because Azure RBAC manages access control (who can do what) but does not enforce tagging rules, restrict VM SKUs, or require HTTPS; it has no compliance dashboard for policy rules. Option C is wrong because Azure Management Groups provide a hierarchical structure to organize subscriptions and apply governance at scale, but they are not the feature that groups policy definitions into a single unit for compliance tracking—they are the scope where initiatives are assigned. Option D is wrong because Azure Resource Graph is a query service for exploring resources across subscriptions, not a mechanism to group policies or track compliance against a set of rules.

Practice this question →

292

MCQmedium

A company has multiple Azure subscriptions organized under a management group hierarchy. They need to assign the 'Contributor' role to a security team for all subscriptions under the 'Production' management group. They also want new subscriptions added later to automatically inherit this role assignment. What should they do?

A.Assign the role at the tenant root management group level

B.Assign the role at the management group level

C.Assign the role at each subscription individually

D.Use an Azure Blueprint to assign the role

AnswerB

Management group role assignments are inherited by all descendant subscriptions, including future ones.

Why this answer

Assigning the 'Contributor' role at the management group level ensures that all subscriptions under that management group inherit the role assignment. When new subscriptions are added to the 'Production' management group, they automatically inherit the role assignment because Azure RBAC supports inheritance down the management group hierarchy. This meets both requirements: immediate coverage and automatic inheritance for future subscriptions.

Exam trap

The trap here is that candidates often confuse management group-level role assignments with tenant root-level assignments, thinking broader scope is better, but the tenant root would grant access to all subscriptions, not just the 'Production' group.

How to eliminate wrong answers

Option A is wrong because assigning the role at the tenant root management group would apply the 'Contributor' role to all subscriptions across the entire Azure AD tenant, not just those under the 'Production' management group, which violates the requirement for scoped access. Option C is wrong because assigning the role at each subscription individually would not allow new subscriptions to automatically inherit the role assignment; each new subscription would require a separate manual assignment. Option D is wrong because Azure Blueprints are used to define and deploy repeatable sets of Azure resources and policies, not to assign RBAC roles; role assignments are managed through Azure RBAC, not Blueprints.

Practice this question →

293

MCQmedium

An administrator needs to grant a user the ability to manage virtual machines in a specific resource group but NOT allow them to modify networking or storage. Which approach is BEST?

A.Assign Owner role at the subscription level

B.Assign Virtual Machine Contributor role scoped to the resource group

C.Assign Contributor role at the resource group level

D.Use Azure Policy to restrict the user's actions

AnswerB

Virtual Machine Contributor grants VM management rights only; scoping to the resource group prevents access to other resources.

Why this answer

The Virtual Machine Contributor role provides exactly the permissions needed to manage virtual machines, including starting, stopping, and restarting them, but explicitly excludes access to the virtual network and storage account resources. By scoping this role to the specific resource group, the administrator ensures the user cannot modify networking or storage resources outside of the VM's operational scope. This is the most precise and secure approach because it follows the principle of least privilege.

Exam trap

The trap here is that candidates often confuse the Contributor role (which grants full management of all resources) with the more specific Virtual Machine Contributor role, or they mistakenly think Azure Policy can be used to restrict user permissions when it is actually a governance tool for enforcing resource compliance, not a substitute for RBAC.

How to eliminate wrong answers

Option A is wrong because the Owner role at the subscription level grants full administrative access to all resources, including networking and storage, which violates the requirement. Option C is wrong because the Contributor role at the resource group level allows full management of all resource types within that group, including networking and storage, thus exceeding the needed permissions. Option D is wrong because Azure Policy is used to enforce compliance rules (e.g., tagging or location restrictions) and cannot directly grant or deny specific RBAC permissions to a user; it is not a substitute for role-based access control.

Practice this question →

294

MCQmedium

A company has a root management group that contains two child management groups: Production and Development. Each child management group contains several subscriptions. The security team assigns a built-in Azure Policy definition with the 'Deny' effect to the Production management group to enforce encryption on all storage accounts. Later, the Development team requests that storage accounts in their subscriptions must not be encrypted because they host temporary test data that needs to be quickly deleted and recreated. The security team must allow this exception for Development only, without changing the policy for Production. What should the security team do?

A.Assign a new policy with the 'Audit' effect at the Development management group to override the Deny effect.

B.Remove the policy assignment from the root management group and assign it individually to each Production subscription.

C.Create an Azure RBAC role assignment that grants the Development team permission to bypass the policy.

D.Create an Azure Policy exemption for the Development management group with the 'Mitigated' category.

AnswerD

Correct. Azure Policy exemptions allow you to exclude a specific scope from policy evaluation. By creating an exemption at the Development management group, the Deny policy from the Production management group will no longer apply to Development subscriptions. The policy remains fully enforced for Production.

Why this answer

Option D is correct because Azure Policy exemptions allow specific scopes (like the Development management group) to be excluded from a policy assignment's effect without modifying the original assignment. The 'Mitigated' category is used when a policy's intent is addressed by another method or when an exception is justified, such as for temporary test data that requires no encryption. This preserves the Deny effect for Production while permitting Development to have unencrypted storage accounts.

Exam trap

The trap here is that candidates confuse Azure Policy exemptions with RBAC permissions or think that a child-scope policy assignment can override a parent-scope Deny effect, when in reality policy inheritance is cumulative and the most restrictive effect always wins unless an explicit exemption is created.

How to eliminate wrong answers

Option A is wrong because assigning a policy with 'Audit' effect at a child scope does not override a 'Deny' effect from a parent scope; Azure Policy inheritance means the most restrictive effect (Deny) takes precedence, so storage accounts would still be denied creation if encryption is missing. Option B is wrong because removing the policy from the root and assigning it individually to each Production subscription is unnecessary and introduces administrative overhead; it does not solve the need for an exception in Development, and the root assignment could have been left in place with an exemption for Development. Option C is wrong because Azure RBAC roles control access to Azure resources (who can create/modify them), not the enforcement of Azure Policy; RBAC cannot bypass a Deny effect, as policy evaluation occurs independently of permissions.

Practice this question →

295

MCQmedium

A company has a production resource group that contains several Azure virtual machines and a SQL database. The company wants to ensure that no user can accidentally delete these resources, but authorized administrators must still be able to modify the configuration and update the resources. The company needs a straightforward governance feature that can be applied directly to the resource group and can be removed only by an authorized user with the Owner role. Which Azure feature should the company use?

A.Azure Policy with a Deny effect to block resource deletions.

B.A Read-Only lock on the resource group.

C.A Delete lock on the resource group.

D.An Azure RBAC role assignment that excludes the Delete action for all users.

AnswerC

A Delete lock prevents deletion of the resource group and its resources while allowing all other operations, including modifications. This directly addresses the requirement to prevent accidental deletion without hindering updates. Resource locks can be applied at the resource group level and only removed by users with Owner or User Access Administrator roles.

Why this answer

A Delete lock on the resource group prevents users from deleting the resource group and its resources, while still allowing authorized administrators with the Owner role to modify configurations and update resources. This lock can only be removed by a user with the Owner role, meeting the requirement for a straightforward governance feature applied directly to the resource group.

Exam trap

The trap here is that candidates often confuse Azure Policy with resource locks, thinking a Deny effect policy is simpler or more appropriate, but Azure Policy is a governance and compliance tool, not a straightforward lock that can be easily toggled by an Owner without policy management overhead.

How to eliminate wrong answers

Option A is wrong because Azure Policy with a Deny effect can block resource deletions but is a policy-based governance tool applied at a management group, subscription, or resource group scope, not a simple lock that can be removed only by an Owner; it requires policy assignment and management, and its removal involves policy administration, not just a lock removal. Option B is wrong because a Read-Only lock prevents all modifications, including configuration changes and updates, which conflicts with the requirement that authorized administrators must still be able to modify and update resources.

Practice this question →

296

MCQmedium

Which Azure service enables organizations to identify and classify sensitive data (like credit card numbers and passport numbers) stored in Azure?

A.Azure Key Vault

B.Microsoft Purview

C.Azure Information Protection

D.Azure Security Center

AnswerB

Microsoft Purview automatically scans and classifies sensitive data (PII, financial data) across Azure and beyond.

Why this answer

Microsoft Purview (formerly Azure Purview) is the correct service because it provides unified data governance, including automated data classification and sensitivity labeling across Azure, on-premises, and multi-cloud environments. It uses built-in classifiers to detect sensitive data types such as credit card numbers (based on Luhn algorithm validation) and passport numbers, and can apply Microsoft Information Protection (MIP) sensitivity labels to the classified data.

Exam trap

The trap here is that candidates confuse Azure Information Protection (a labeling tool) with the broader data classification and governance capabilities of Microsoft Purview, assuming that AIP alone can discover and classify data at rest across Azure services.

How to eliminate wrong answers

Option A is wrong because Azure Key Vault is a secrets management service for storing cryptographic keys, certificates, and connection strings; it does not scan or classify data content. Option C is wrong because Azure Information Protection (now part of Microsoft Purview) is a labeling and protection solution that applies sensitivity labels but does not perform automated data discovery and classification across Azure storage; that capability is provided by Microsoft Purview Data Map and Data Catalog. Option D is wrong because Azure Security Center (now Microsoft Defender for Cloud) is a cloud security posture management (CSPM) and workload protection service; it does not classify sensitive data types like credit card or passport numbers.

Practice this question →

297

MCQmedium

Which Azure feature provides audit logs that record every action taken on secrets in Azure Key Vault?

A.Azure Policy

B.Azure Key Vault diagnostic logging

C.Azure Monitor Metrics

D.Azure RBAC access logs

AnswerB

Key Vault diagnostic logging records all vault operations — who accessed secrets/keys, when, and from where — for audit and compliance.

Why this answer

Azure Key Vault diagnostic logging captures detailed audit logs for every operation performed on secrets, keys, and certificates, including read, write, delete, and backup actions. These logs are sent to Azure Monitor Logs, Storage Accounts, or Event Hubs, enabling security auditing and compliance monitoring. This is the correct feature because it directly records all actions on secrets at the vault level.

Exam trap

The trap here is that candidates confuse Azure Monitor Metrics (which shows performance counters) with diagnostic logs (which show detailed audit trails), or they assume Azure Policy or RBAC logs inherently record all secret actions, when in fact only diagnostic logging captures the granular operation-level audit data.

How to eliminate wrong answers

Option A is wrong because Azure Policy enforces organizational standards and compliance rules across resources, but it does not generate audit logs of individual actions on secrets in Key Vault. Option C is wrong because Azure Monitor Metrics collects numerical performance data (e.g., latency, request count) but does not capture detailed audit trails of specific secret operations. Option D is wrong because Azure RBAC access logs are not a standalone feature; RBAC controls permissions via role assignments, and audit logs for RBAC actions are part of Azure Activity Logs, not a separate log type that records every action on secrets.

Practice this question →

298

MCQmedium

A company has an Azure subscription with 200 virtual machines. The compliance team requires that all virtual machines have diagnostic settings enabled to send metrics and logs to a central Log Analytics workspace. The team wants Azure to automatically configure these diagnostic settings on any VM that currently lacks them, without manual intervention. Which Azure Policy effect should the team use in the policy definition?

A.Audit

B.Deny

C.DeployIfNotExists

D.Modify

AnswerC

DeployIfNotExists is designed to deploy a template or resource when a non-compliant condition is detected. In this case, it would automatically create the missing diagnostic settings on each VM, achieving automatic remediation.

Why this answer

The DeployIfNotExists effect is correct because it automatically deploys a diagnostic settings configuration to any VM that lacks it, ensuring compliance without manual intervention. This effect evaluates resources and, if they do not meet the condition (missing diagnostic settings), triggers a deployment to remediate them. Audit only logs non-compliance without fixing it, and Deny blocks non-compliant creation but does not remediate existing VMs.

Exam trap

The trap here is that candidates often confuse Audit (which only reports) with DeployIfNotExists (which actively remediates), or mistakenly think Deny can retroactively fix existing resources when it only blocks new non-compliant deployments.

How to eliminate wrong answers

Option A is wrong because Audit only logs compliance state without taking any action to configure diagnostic settings on existing VMs. Option B is wrong because Deny prevents creation of new VMs without diagnostic settings but does not automatically configure settings on already deployed VMs.

Practice this question →

299

MCQmedium

A company runs several Azure virtual machines and an Azure SQL Database in a single subscription. The operations team needs a single, personalized dashboard that displays the current health status of these specific resources, as well as any upcoming planned maintenance events from Microsoft that might affect them. The team wants to see all this information in one place without having to navigate multiple tools. Which Azure service should the operations team use to meet these requirements?

A.Azure Service Health

B.Azure Resource Health

C.Azure Monitor

D.Azure Advisor

AnswerA

Correct. Azure Service Health provides a personalized dashboard showing the health of your specific Azure resources, including current issues, past incidents, and upcoming planned maintenance that may affect them.

Why this answer

Azure Service Health provides a personalized dashboard that shows the health of your specific Azure services and resources, including Azure virtual machines and SQL Database, in a single subscription. It also surfaces upcoming planned maintenance events from Microsoft that could affect those resources, meeting the requirement for a unified view without navigating multiple tools.

Exam trap

The trap here is that candidates often confuse Azure Service Health with Azure Monitor, thinking Monitor provides a built-in dashboard for service health and planned maintenance, when in fact Monitor is a broader tool for metrics and logs, not a dedicated service health dashboard.

How to eliminate wrong answers

Option B is wrong because Azure Resource Health focuses on the health of individual resources (e.g., a specific VM or database) and does not aggregate a personalized dashboard for multiple resources or show planned maintenance events from Microsoft. Option C is wrong because Azure Monitor is a comprehensive monitoring and analytics service for collecting metrics, logs, and alerts, but it does not natively provide a single, personalized dashboard specifically for service health and planned maintenance events; it requires additional configuration and integration to surface that information.

Practice this question →

300

MCQmedium

A company wants to ensure that all new Azure storage accounts have a specific encryption setting enabled. They also want to automatically remediate any existing non-compliant storage accounts without manual effort. Which Azure Policy effect should they use?

A.Append

B.AuditIfNotExists

C.DeployIfNotExists

D.Deny

AnswerC

DeployIfNotExists deploys a configuration to enforce the encryption setting on both new and existing resources.

Why this answer

DeployIfNotExists is the correct effect because it not only evaluates the compliance of storage accounts against the encryption policy but also automatically deploys a remediation task (e.g., enabling encryption via a linked ARM template or Azure function) to bring non-compliant resources into compliance without manual intervention. This effect is specifically designed for scenarios where the resource itself needs to be modified or configured to meet the policy requirement.

Exam trap

The trap here is that candidates often confuse AuditIfNotExists (which only audits) with DeployIfNotExists (which both audits and automatically remediates), assuming that any 'IfNotExists' effect provides automatic fixing, but only DeployIfNotExists includes the deployment action for remediation.

How to eliminate wrong answers

Option A is wrong because Append is used to add additional fields or tags to a resource during creation or update, but it cannot modify existing settings like encryption on a storage account. Option B is wrong because AuditIfNotExists only audits and logs non-compliance without any automatic remediation; it does not deploy any configuration changes. Option D is wrong because Deny blocks the creation or update of resources that violate the policy, but it cannot remediate existing non-compliant storage accounts.

Practice this question →