CCNA Describe Azure management and governance Questions — Page 5 of 5

301

MCQmedium

Which Azure feature allows administrators to set a maximum spending limit to prevent unexpected charges on a subscription?

A.Azure Policy

B.Azure Cost Management budgets

C.Azure Reservations

D.Azure Advisor cost recommendations

AnswerB

Azure Cost Management budgets enable you to define a monetary threshold for a subscription, resource group, or management group over a monthly, quarterly, or annual period, and then configure alerts that fire when actual spending reaches a specified percentage of that budget (for example, 90%). These alerts can send email notifications or trigger automated actions, such as a webhook to an automation runbook, making them the correct native service for notifying you when costs approach or exceed your limits. While budgets do not automatically block resource creation by default, they are the primary cost governance tool for setting spending thresholds and alerting, which directly matches the scenario in the question.

Why this answer

Azure Cost Management budgets allow administrators to set spending limits and receive alerts when costs exceed thresholds, preventing unexpected charges. This feature directly controls subscription spending by defining budget amounts and actions, such as disabling resources or sending notifications, when the budget is reached.

Exam trap

The trap here is confusing governance features like Azure Policy (which enforces rules on resource properties) with cost control features, leading candidates to select Azure Policy instead of the correct budget functionality.

How to eliminate wrong answers

Option A is wrong because Azure Policy enforces organizational rules and compliance by evaluating resource configurations, not by setting spending limits or preventing charges. Option C is wrong because Azure Reservations provide discounted pricing for committing to specific services upfront, but they do not set a maximum spending limit or prevent unexpected charges. Option D is wrong because Azure Advisor cost recommendations offer suggestions to optimize spending, but they do not enforce a spending cap or block charges.

Practice this question →

302

MCQmedium

An IT administrator needs to query all Azure resources across multiple subscriptions to find all virtual machines that were created in the last 30 days. They want to use a powerful query language. Which Azure service should they use?

A.Azure Resource Graph

B.Azure Monitor

C.Azure Resource Manager

D.Azure CLI

AnswerA

Azure Resource Graph is a purpose-built service in Azure that lets you query the complete resource inventory across subscriptions, management groups, and the entire tenant using the Kusto Query Language (KQL). It efficiently explores resource properties such as tags, location, SKU, and configuration details in a single query, making it the ideal tool for resource discovery and large-scale filtering.

Why this answer

Azure Resource Graph is the correct service because it provides a powerful, Kusto Query Language (KQL)-based query engine that can efficiently explore and query Azure resources across multiple subscriptions, resource groups, and locations. It is specifically designed for resource discovery and inventory scenarios, such as finding all virtual machines created in the last 30 days, by filtering on properties like `createdTime`.

Exam trap

The trap here is that candidates confuse Azure Monitor’s log querying capabilities (also using KQL) with Azure Resource Graph’s resource metadata querying, but Azure Monitor cannot query resource properties like creation time across subscriptions—it only queries telemetry data.

Why the other options are wrong

Azure Monitor is for collecting and analyzing telemetry data (metrics, logs) from resources, not for querying resource metadata across subscriptions using a powerful query language like KQL.

Azure Resource Manager (ARM) is the deployment and management service for Azure, not a query service. It does not provide a query language to search across resources; it handles resource provisioning and management via templates and APIs.

Azure CLI is a command-line tool for managing Azure resources, not a service for querying resources across subscriptions with a powerful query language like KQL.

Practice this question →

303

MCQmedium

A company has a policy that all Azure resources deployed to production subscriptions must be tagged with a 'CostCenter' tag. They want to automatically prevent the creation of any resource that does not include this tag. Which Azure Policy effect should they use in their policy definition?

A.Audit

B.Deny

C.DeployIfNotExists

D.Modify

AnswerB

The Deny effect stops a resource from being created or updated when a policy condition is not satisfied, such as a missing required tag. Azure Policy evaluates this during the deployment request, returning an error before any resource is provisioned. This makes it a proactive enforcement mechanism that ensures only compliant resources exist at the moment they are deployed, directly meeting the requirement to block non-compliant production resources.

Why this answer

The Deny effect is correct because it actively prevents the creation or deployment of any Azure resource that does not comply with the policy rule, such as missing the required 'CostCenter' tag. Unlike Audit, which only logs compliance violations without blocking the operation, Deny enforces the policy at the time of the resource creation request, ensuring non-compliant resources are never provisioned.

Exam trap

The trap here is that candidates often confuse the Audit effect (which only reports non-compliance) with the Deny effect (which actively blocks the operation), mistakenly thinking that logging alone is sufficient to enforce a policy.

Why the other options are wrong

Audit only logs non-compliant resources but does not block creation; the requirement is to prevent creation, which requires Deny.

DeployIfNotExists does not prevent resource creation; it only deploys a resource (e.g., a remediation task) after the resource is created, so it cannot block resources missing the tag.

Modify is used to add or change tags on existing or new resources, but it does not prevent creation; it only alters the resource after creation or during deployment. The requirement is to block creation entirely, which requires Deny.

Practice this question →

304

MCQeasy

Which Azure feature automatically turns off virtual machines at a scheduled time daily to reduce development costs?

A.Azure Policy VM power state enforcement

B.Azure VM Auto-Shutdown

C.Azure DevTest Labs cost controls

D.Azure Automation runbooks for VM shutdown

AnswerB

Azure VM Auto-Shutdown is the native feature built into every Azure virtual machine (ARM and classic) that lets you specify a daily time for the VM to be automatically shut down and deallocated, halting compute billing. You can enable it at VM creation or on an existing VM via the portal, and it supports time zones and optional email notifications, making it the direct solution for reducing costs in dev/test environments.

Why this answer

Azure VM Auto-Shutdown is a built-in feature that allows you to schedule automatic shutdown of virtual machines at a specified time daily, reducing costs by ensuring VMs are not running when not needed. It is configured directly on the VM blade in the Azure portal and requires no additional scripting or automation services.

Exam trap

The trap here is that candidates confuse Azure DevTest Labs cost controls (which also offer auto-shutdown) with the general Azure VM Auto-Shutdown feature, but DevTest Labs is a separate service for lab environments, not the built-in VM-level setting.

How to eliminate wrong answers

Option A is wrong because Azure Policy VM power state enforcement is used to audit or enforce compliance rules (e.g., preventing VMs from being started outside business hours), but it does not provide a scheduled daily shutdown feature—it relies on policy definitions and remediation tasks, not a simple time-based schedule. Option C is wrong because Azure DevTest Labs cost controls include auto-shutdown policies for lab VMs, but this is a feature within the DevTest Labs service, not a general Azure feature applicable to all VMs outside a lab environment. Option D is wrong because Azure Automation runbooks for VM shutdown require custom PowerShell or Python scripts and a schedule linked to a runbook, which is more complex and not a built-in, one-click feature like VM Auto-Shutdown.

Practice this question →

305

MCQmedium

An organization needs to ensure that all Azure resources comply with internal standards and automatically remediate non-compliant resources. Which Azure service provides this capability?

A.Azure Blueprints

B.Azure Policy with remediation tasks

C.Azure RBAC

D.Azure Security Center

AnswerB

Azure Policy is the correct answer because it evaluates Azure resources against defined rules and, when configured with the DeployIfNotExists or Modify policy effects, can automatically remediate non-compliant resources using remediation tasks. These remediation tasks are executed by Azure Policy on a scheduled basis or after a policy assignment is updated, and they deploy the necessary resource changes (e.g., enabling encryption, adding a diagnostic setting) so that resources converge to a compliant state. This goes beyond simple alerting or recommendations—Policy actively enforces and corrects misconfigurations, making it the compliance enforcement and remediation engine in Azure.

Why this answer

Azure Policy with remediation tasks is the correct service because it allows organizations to define compliance rules for Azure resources and automatically remediate non-compliant resources using managed identities and policy effects like 'deployIfNotExists' or 'modify'. This ensures ongoing compliance with internal standards without manual intervention.

Exam trap

The trap here is that candidates often confuse Azure Blueprints (which can include policies but does not perform remediation) with Azure Policy's remediation tasks, or they think Azure Security Center handles all compliance, when in fact it focuses on security-specific compliance (e.g., CIS benchmarks) rather than general internal standards.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints is used for orchestrating the deployment of resource templates, policies, and role assignments as a package, but it does not automatically remediate non-compliant resources after deployment. Option C is wrong because Azure RBAC (Role-Based Access Control) manages who has access to Azure resources and what actions they can perform, but it does not enforce resource configuration compliance or provide remediation capabilities. Option D is wrong because Azure Security Center (now Microsoft Defender for Cloud) provides security posture management and threat protection, but its primary focus is security vulnerabilities and threats, not general compliance with internal standards or automated remediation of non-compliant resources.

Practice this question →

306

MCQmedium

A multinational company has multiple Azure subscriptions managed by different teams. The compliance team requires that all new virtual machines deployed in any subscription must have a specific tag (e.g., 'CostCenter') and must be deployed in approved regions only. They also want to automatically enforce these requirements without manual intervention. Which Azure service should the compliance team use to achieve this?

A.Azure Policy

B.Azure Role-Based Access Control (RBAC)

C.Azure Blueprints

D.Azure Management Groups

AnswerA

Correct. Azure Policy allows you to create, assign, and manage policies that enforce rules and effects over your resources. In this scenario, a policy can automatically add a required tag and restrict allowed regions when virtual machines are created.

Why this answer

Azure Policy is correct because it enables the compliance team to create, assign, and manage policies that enforce rules (like requiring a 'CostCenter' tag and restricting VM deployment to approved regions) across all subscriptions. Policies are evaluated during resource creation and can automatically deny or audit non-compliant resources, ensuring enforcement without manual intervention.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces rules on resources) with Azure Blueprints (which packages policies, RBAC, and resources for environment setup), but Blueprints does not enforce compliance on its own.

Why the other options are wrong

Azure RBAC manages permissions to Azure resources (who can do what), but cannot enforce resource configuration like tags or approved regions. The question requires automatic enforcement of resource properties, which is a policy, not access control.

Azure Blueprints is used to orchestrate the deployment of resource templates and policy assignments, but it does not enforce compliance automatically; it requires manual deployment or updates. The question specifically asks for automatic enforcement without manual intervention, which is a core feature of Azure Policy.

Azure Management Groups organize subscriptions hierarchically but do not enforce resource-level rules like tagging or region restrictions. They lack the policy engine needed to automatically audit or enforce compliance requirements on deployed resources.

Practice this question →

307

MCQmedium

A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?

A.Assign a custom role-based access control (RBAC) role that denies the delete action for all users.

B.Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.

C.Apply a resource lock of type 'Delete' at the subscription level.

D.Apply a resource lock of type 'ReadOnly' at the subscription level.

AnswerC

This is correct. A 'Delete' lock prevents the subscription from being deleted but allows read and update operations on the resources inside. Resource locks apply to all users, including Owners, and can be set at subscription, resource group, or resource level. This directly meets the requirement to protect against accidental deletion while still allowing modifications.

Why this answer

A resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.

Exam trap

The trap here is that candidates confuse Azure Policy (which governs resource configuration compliance) with resource locks (which protect against accidental deletion or modification at the management plane), leading them to choose Azure Policy instead of the correct lock type.

Why the other options are wrong

Custom RBAC roles cannot override the Owner role's permissions, and even if they deny delete, the Owner role can modify or remove the role assignment, so it does not prevent subscription deletion by an Owner.

Azure Policy with 'Deny' effect can block creation or modification of resources based on properties, but it cannot prevent the delete action on the subscription itself; subscription deletion is controlled by Azure RBAC and resource locks, not Azure Policy.

A 'ReadOnly' lock prevents all modifications to resources, including changes to configurations and data, which is too restrictive. The question requires allowing modifications to resources inside the subscription while only preventing deletion of the subscription itself.

Practice this question →

308

MCQmedium

A company's finance team uses Azure Cost Management + Billing to monitor cloud spending. They want to configure a rule that sends an email notification to the finance team's distribution list when the monthly cost for resources tagged with Department=Marketing exceeds $10,000. Which Azure Cost Management feature should they configure?

A.Budget

B.Invoice

C.Cost analysis

D.Recommendations

AnswerA

In Azure Cost Management + Billing, a budget is a dedicated alerting construct that lets you define a spending limit at a chosen scope (such as a subscription or resource group) and set thresholds—both for actual costs and forecasted costs. When a threshold is crossed, Azure automatically sends an email notification to the specified recipients, making budgets the correct proactive tool for this scenario. Budgets can also be configured to trigger automation actions, but their core purpose is to monitor and alert on expenditure versus the defined limit.

Why this answer

Azure Budgets allow you to set cost or usage thresholds and configure alerts that trigger when spending reaches a specified percentage of the budget. In this scenario, the finance team can create a budget with a $10,000 threshold for the Department=Marketing tag, and configure an alert rule to send an email notification to the distribution list when costs exceed that amount.

Exam trap

The trap here is that candidates confuse the reporting capabilities of Cost analysis (which shows past spending) with the proactive alerting functionality of Budgets, leading them to select Cost analysis instead of Budget.

Why the other options are wrong

Invoice is a billing document that summarizes charges for a billing period; it does not support creating alert rules based on cost thresholds for specific tags.

Cost analysis provides historical data and visualizations of costs but does not support proactive alerting or automated email notifications based on cost thresholds.

Recommendations provide optimization suggestions to reduce costs, but they do not support configuring email alerts based on cost thresholds for specific tags.

Practice this question →