Topic 03 Practice Test 2 covers Azure Subscriptions and Governance for Microsoft Azure Administrator AZ-104 and maps to the objective: Manage Azure subscriptions and governance. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
- Datum wants a resource group to be viewable but not modified during a change freeze. Which management lock is the best fit? Choose ONE.
- Apply a ReadOnly resource lock
- Grant or use permissions that include Microsoft.Authorization/locks/* to manage the lock
- Use an Azure Policy definition with an Audit effect
- Apply a CanNotDelete resource lock
Correct Answer: A
Correct Answer
Answer A is correct because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. Applied to A. Datum, the capability meets the requirement that control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because Creating or deleting a management lock requires lock-management permissions; ordinary resource write permissions are not sufficient. For A. Datum, that does not satisfy the requirement that control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible; it solves a different administrative need.
Answer C is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. In A. Datum, this is not sufficient because control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible; the capability addresses a neighboring use case.
Answer D is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. The A. Datum scenario instead requires that control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible, so this option would leave the key requirement unresolved.
Question 2
Contoso wants a CanNotDelete lock to cover every resource in RG-Prod without adding separate locks to each resource. Where should the lock be placed? Choose ONE.
- Apply a ReadOnly resource lock
- Apply the lock at the parent resource group or subscription scope
- Apply a CanNotDelete resource lock
- Place resources with a common lifecycle in the same resource group
Correct Answer: B
Correct Answer
Answer B is correct because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. For Contoso, that directly satisfies the requirement that one lock should protect all child resources through inheritance.
Incorrect Answers
Answer A is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. The Contoso scenario instead requires that one lock should protect all child resources through inheritance, so this option would leave the key requirement unresolved.
Answer C is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. In Contoso, this is not sufficient because one lock should protect all child resources through inheritance; the capability addresses a neighboring use case.
Answer D is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. Applied to Contoso, this does not provide the required behavior because one lock should protect all child resources through inheritance.
Question 3
Fabrikam needs one inherited lock across all resources in a subscription. Which approach provides that coverage? Choose ONE.
- Apply a CanNotDelete resource lock
- Apply a ReadOnly resource lock
- Apply the lock at the parent resource group or subscription scope
- Place resources with a common lifecycle in the same resource group
Correct Answer: C
Correct Answer
Answer C is correct because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. In Fabrikam, this is the best fit because one lock should protect all child resources through inheritance.
Incorrect Answers
Answer A is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. For Fabrikam, that does not satisfy the requirement that one lock should protect all child resources through inheritance; it solves a different administrative need.
Answer B is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. Applied to Fabrikam, this does not provide the required behavior because one lock should protect all child resources through inheritance.
Answer D is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. The Fabrikam scenario instead requires that one lock should protect all child resources through inheritance, so this option would leave the key requirement unresolved.
Question 4
Northwind’s Owner cannot delete a locked resource during approved decommissioning. What must happen before deletion can succeed? Choose ONE.
- Apply a CanNotDelete resource lock
- Grant or use permissions that include Microsoft.Authorization/locks/* to manage the lock
- Apply a ReadOnly resource lock
- Remove the management lock before performing the blocked operation
Correct Answer: D
Correct Answer
Answer D is correct because Management locks apply even to highly privileged users; the lock must be removed by an identity with lock-management permission before the protected operation can proceed. The the northwind s owner cannot case scenario specifically requires that a protected operation is legitimately required and the management lock is what blocks it, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. For the northwind s owner cannot case, that does not satisfy the requirement that a protected operation is legitimately required and the management lock is what blocks it; it solves a different administrative need.
Answer B is incorrect because Creating or deleting a management lock requires lock-management permissions; ordinary resource write permissions are not sufficient. Applied to the northwind s owner cannot case, this does not provide the required behavior because a protected operation is legitimately required and the management lock is what blocks it.
Answer C is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. In the northwind s owner cannot case, this is not sufficient because a protected operation is legitimately required and the management lock is what blocks it; the capability addresses a neighboring use case.
Question 5
Adventure Works approves a maintenance operation that a ReadOnly lock blocks. What is the required administrative step before the operation? Choose ONE.
- Remove the management lock before performing the blocked operation
- Apply a ReadOnly resource lock
- Grant or use permissions that include Microsoft.Authorization/locks/* to manage the lock
- Apply a CanNotDelete resource lock
Correct Answer: A
Correct Answer
Answer A is correct because Management locks apply even to highly privileged users; the lock must be removed by an identity with lock-management permission before the protected operation can proceed. Applied to Adventure Works, the capability meets the requirement that a protected operation is legitimately required and the management lock is what blocks it without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. For Adventure Works, that does not satisfy the requirement that a protected operation is legitimately required and the management lock is what blocks it; it solves a different administrative need.
Answer C is incorrect because Creating or deleting a management lock requires lock-management permissions; ordinary resource write permissions are not sufficient. The Adventure Works scenario instead requires that a protected operation is legitimately required and the management lock is what blocks it, so this option would leave the key requirement unresolved.
Answer D is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. In Adventure Works, this is not sufficient because a protected operation is legitimately required and the management lock is what blocks it; the capability addresses a neighboring use case.
Question 6
Tailspin tags RG-App with CostCenter=42 and expects child resources to inherit it, but they do not. What should it implement for consistent resource tagging? Choose ONE.
- Apply the required tag directly to the target resource
- Use Azure Policy to add or require the tag on child resources
- Place resources with a common lifecycle in the same resource group
- Use an Azure Policy definition with the Modify effect
Correct Answer: B
Correct Answer
Answer B is correct because Tags placed on a resource group are not automatically inherited by contained resources; Azure Policy can enforce or add required tags. For the tailspin tags rg-app with case, that directly satisfies the requirement that resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance.
Incorrect Answers
Answer A is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. In the tailspin tags rg-app with case, this is not sufficient because resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance; the capability addresses a neighboring use case.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. Applied to the tailspin tags rg-app with case, this does not provide the required behavior because resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance.
Answer D is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. The the tailspin tags rg-app with case scenario instead requires that resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance, so this option would leave the key requirement unresolved.
Question 7
Woodgrove wants every resource created in selected resource groups to carry a required business tag automatically. Which governance mechanism is appropriate? Choose ONE.
- Use an Azure Policy definition with the Modify effect
- Place resources with a common lifecycle in the same resource group
- Use Azure Policy to add or require the tag on child resources
- Apply the required tag directly to the target resource
Correct Answer: C
Correct Answer
Answer C is correct because Tags placed on a resource group are not automatically inherited by contained resources; Azure Policy can enforce or add required tags. In the woodgrove wants every resource case, this is the best fit because resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance.
Incorrect Answers
Answer A is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. Applied to the woodgrove wants every resource case, this does not provide the required behavior because resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance.
Answer B is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. The the woodgrove wants every resource case scenario instead requires that resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance, so this option would leave the key requirement unresolved.
Answer D is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. For the woodgrove wants every resource case, that does not satisfy the requirement that resources should consistently receive a tag based on governance rather than relying on resource-group tag inheritance; it solves a different administrative need.
Question 8
Proseware needs to add Environment=Prod to one existing VM only. What is the most direct action? Choose ONE.
- Use Azure Policy to add or require the tag on child resources
- Place resources with a common lifecycle in the same resource group
- Use an Azure management group above the subscriptions
- Apply the required tag directly to the target resource
Correct Answer: D
Correct Answer
Answer D is correct because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. The Proseware scenario specifically requires that one existing resource needs metadata updated immediately and no inheritance behavior is required, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Tags placed on a resource group are not automatically inherited by contained resources; Azure Policy can enforce or add required tags. Applied to Proseware, this does not provide the required behavior because one existing resource needs metadata updated immediately and no inheritance behavior is required.
Answer B is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. For Proseware, that does not satisfy the requirement that one existing resource needs metadata updated immediately and no inheritance behavior is required; it solves a different administrative need.
Answer C is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. In Proseware, this is not sufficient because one existing resource needs metadata updated immediately and no inheritance behavior is required; the capability addresses a neighboring use case.
Question 9
Litware changes the Owner tag on one storage account without altering the resource-group tag. Which action should it take? Choose ONE.
- Apply the required tag directly to the target resource
- Use Azure Policy to add or require the tag on child resources
- Place resources with a common lifecycle in the same resource group
- Use an Azure management group above the subscriptions
Correct Answer: A
Correct Answer
Answer A is correct because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. Applied to Litware, the capability meets the requirement that one existing resource needs metadata updated immediately and no inheritance behavior is required without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because Tags placed on a resource group are not automatically inherited by contained resources; Azure Policy can enforce or add required tags. The Litware scenario instead requires that one existing resource needs metadata updated immediately and no inheritance behavior is required, so this option would leave the key requirement unresolved.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. In Litware, this is not sufficient because one existing resource needs metadata updated immediately and no inheritance behavior is required; the capability addresses a neighboring use case.
Answer D is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. For Litware, that does not satisfy the requirement that one existing resource needs metadata updated immediately and no inheritance behavior is required; it solves a different administrative need.
Question 10
An organization wants to protect a production resource group from deletion while still allowing authorized configuration changes. Which TWO statements are correct? Choose TWO.
- Review Azure Advisor cost recommendations
- Apply a CanNotDelete resource lock
- Apply a ReadOnly resource lock
- Use an Azure Policy definition with the Deny effect
- Apply the lock at the parent resource group or subscription scope
Correct Answers: B, E
Correct Answers
Answer B is correct because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. For the an organization wants to case, that directly satisfies the requirement that CanNotDelete is the appropriate lock and a parent-scope lock is inherited by the child resources.
Answer E is correct because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. In the an organization wants to case, this is the best fit because CanNotDelete is the appropriate lock and a parent-scope lock is inherited by the child resources.
Incorrect Answers
Answer A is incorrect because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. For the an organization wants to case, that does not satisfy the requirement that CanNotDelete is the appropriate lock and a parent-scope lock is inherited by the child resources; it solves a different administrative need.
Answer C is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. The the an organization wants to case scenario instead requires that CanNotDelete is the appropriate lock and a parent-scope lock is inherited by the child resources, so this option would leave the key requirement unresolved.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. Applied to the an organization wants to case, this does not provide the required behavior because CanNotDelete is the appropriate lock and a parent-scope lock is inherited by the child resources.
Question 11
Wingtip is designing an application whose web, storage, and monitoring resources are deployed and retired together. Where should it group them for lifecycle management? Choose ONE.
- Use the supported Azure resource move operation after validating move prerequisites
- Use an Azure management group above the subscriptions
- Place resources with a common lifecycle in the same resource group
- Apply the required tag directly to the target resource
Correct Answer: C
Correct Answer
Answer C is correct because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. In the wingtip is designing an case, this is the best fit because the resources share a lifecycle and should be managed together as an Azure management container.
Incorrect Answers
Answer A is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. Applied to the wingtip is designing an case, this does not provide the required behavior because the resources share a lifecycle and should be managed together as an Azure management container.
Answer B is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. The the wingtip is designing an case scenario instead requires that the resources share a lifecycle and should be managed together as an Azure management container, so this option would leave the key requirement unresolved.
Answer D is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. For the wingtip is designing an case, that does not satisfy the requirement that the resources share a lifecycle and should be managed together as an Azure management container; it solves a different administrative need.
Question 12
- Datum wants a management container for resources that should be deployed and deleted as one application lifecycle. Which Azure construct should it use? Choose ONE.
- Use the supported Azure resource move operation after validating move prerequisites
- Use an Azure management group above the subscriptions
- Apply the required tag directly to the target resource
- Place resources with a common lifecycle in the same resource group
Correct Answer: D
Correct Answer
Answer D is correct because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. The A. Datum scenario specifically requires that the resources share a lifecycle and should be managed together as an Azure management container, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. For A. Datum, that does not satisfy the requirement that the resources share a lifecycle and should be managed together as an Azure management container; it solves a different administrative need.
Answer B is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. In A. Datum, this is not sufficient because the resources share a lifecycle and should be managed together as an Azure management container; the capability addresses a neighboring use case.
Answer C is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. Applied to A. Datum, this does not provide the required behavior because the resources share a lifecycle and should be managed together as an Azure management container.
Question 13
Contoso confirms that every resource in RG-OldApp can be removed. Which resource-group action will also remove the contained resources? Choose ONE.
- Delete the resource group only when all contained resources should also be removed
- Use the supported Azure resource move operation after validating move prerequisites
- Apply a CanNotDelete resource lock
- Keep the resources in separate resource groups and allow them to communicate as required
Correct Answer: A
Correct Answer
Answer A is correct because Deleting a resource group initiates deletion of the resources contained in that group, so it is a lifecycle operation rather than a simple folder deletion. Applied to Contoso, the capability meets the requirement that all resources inside the resource group are intentionally being decommissioned together without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. In Contoso, this is not sufficient because all resources inside the resource group are intentionally being decommissioned together; the capability addresses a neighboring use case.
Answer C is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. For Contoso, that does not satisfy the requirement that all resources inside the resource group are intentionally being decommissioned together; it solves a different administrative need.
Answer D is incorrect because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. The Contoso scenario instead requires that all resources inside the resource group are intentionally being decommissioned together, so this option would leave the key requirement unresolved.
Question 14
Fabrikam plans a complete teardown of an obsolete resource group and all of its contents. What should it expect when deleting the group? Choose ONE.
- Use the supported Azure resource move operation after validating move prerequisites
- Delete the resource group only when all contained resources should also be removed
- Apply a CanNotDelete resource lock
- Keep the resources in separate resource groups and allow them to communicate as required
Correct Answer: B
Correct Answer
Answer B is correct because Deleting a resource group initiates deletion of the resources contained in that group, so it is a lifecycle operation rather than a simple folder deletion. For Fabrikam, that directly satisfies the requirement that all resources inside the resource group are intentionally being decommissioned together.
Incorrect Answers
Answer A is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. The Fabrikam scenario instead requires that all resources inside the resource group are intentionally being decommissioned together, so this option would leave the key requirement unresolved.
Answer C is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. Applied to Fabrikam, this does not provide the required behavior because all resources inside the resource group are intentionally being decommissioned together.
Answer D is incorrect because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. In Fabrikam, this is not sufficient because all resources inside the resource group are intentionally being decommissioned together; the capability addresses a neighboring use case.
Question 15
Northwind has an app in RG-App and a database in RG-Data. They have different lifecycles but must communicate. What is the best design conclusion? Choose ONE.
- Place resources with a common lifecycle in the same resource group
- Use the supported Azure resource move operation after validating move prerequisites
- Keep the resources in separate resource groups and allow them to communicate as required
- Use an Azure management group above the subscriptions
Correct Answer: C
Correct Answer
Answer C is correct because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. In the northwind has an app case, this is the best fit because two resources may remain in different resource groups because resource-group membership does not prevent communication.
Incorrect Answers
Answer A is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. Applied to the northwind has an app case, this does not provide the required behavior because two resources may remain in different resource groups because resource-group membership does not prevent communication.
Answer B is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. The the northwind has an app case scenario instead requires that two resources may remain in different resource groups because resource-group membership does not prevent communication, so this option would leave the key requirement unresolved.
Answer D is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. For the northwind has an app case, that does not satisfy the requirement that two resources may remain in different resource groups because resource-group membership does not prevent communication; it solves a different administrative need.
Question 16
Adventure Works assumes related resources must share a resource group to connect. Which correction should the architect make? Choose ONE.
- Place resources with a common lifecycle in the same resource group
- Use an Azure management group above the subscriptions
- Use the supported Azure resource move operation after validating move prerequisites
- Keep the resources in separate resource groups and allow them to communicate as required
Correct Answer: D
Correct Answer
Answer D is correct because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. The Adventure Works scenario specifically requires that two resources may remain in different resource groups because resource-group membership does not prevent communication, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. For Adventure Works, that does not satisfy the requirement that two resources may remain in different resource groups because resource-group membership does not prevent communication; it solves a different administrative need.
Answer B is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. Applied to Adventure Works, this does not provide the required behavior because two resources may remain in different resource groups because resource-group membership does not prevent communication.
Answer C is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. In Adventure Works, this is not sufficient because two resources may remain in different resource groups because resource-group membership does not prevent communication; the capability addresses a neighboring use case.
Question 17
Tailspin needs to transfer supported resources from RG-Test to RG-Prod. What Azure operation should it use after checking move support and dependencies? Choose ONE.
- Use the supported Azure resource move operation after validating move prerequisites
- Keep the resources in separate resource groups and allow them to communicate as required
- Keep each resource in exactly one resource group at a time
- Delete the resource group only when all contained resources should also be removed
Correct Answer: A
Correct Answer
Answer A is correct because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. Applied to the tailspin needs to transfer case, the capability meets the requirement that a supported resource must change administrative grouping without being recreated, after move prerequisites are validated without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. In the tailspin needs to transfer case, this is not sufficient because a supported resource must change administrative grouping without being recreated, after move prerequisites are validated; the capability addresses a neighboring use case.
Answer C is incorrect because An Azure resource belongs to one resource group at a time, even though it can interact with resources located in other resource groups. The the tailspin needs to transfer case scenario instead requires that a supported resource must change administrative grouping without being recreated, after move prerequisites are validated, so this option would leave the key requirement unresolved.
Answer D is incorrect because Deleting a resource group initiates deletion of the resources contained in that group, so it is a lifecycle operation rather than a simple folder deletion. For the tailspin needs to transfer case, that does not satisfy the requirement that a supported resource must change administrative grouping without being recreated, after move prerequisites are validated; it solves a different administrative need.
Question 18
Woodgrove reorganizes subscriptions and wants to move a supported resource to another resource group. What should the administrator do first and then perform? Choose ONE.
- Delete the resource group only when all contained resources should also be removed
- Use the supported Azure resource move operation after validating move prerequisites
- Keep each resource in exactly one resource group at a time
- Keep the resources in separate resource groups and allow them to communicate as required
Correct Answer: B
Correct Answer
Answer B is correct because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. For the woodgrove reorganizes subscriptions and case, that directly satisfies the requirement that a supported resource must change administrative grouping without being recreated, after move prerequisites are validated.
Incorrect Answers
Answer A is incorrect because Deleting a resource group initiates deletion of the resources contained in that group, so it is a lifecycle operation rather than a simple folder deletion. Applied to the woodgrove reorganizes subscriptions and case, this does not provide the required behavior because a supported resource must change administrative grouping without being recreated, after move prerequisites are validated.
Answer C is incorrect because An Azure resource belongs to one resource group at a time, even though it can interact with resources located in other resource groups. In the woodgrove reorganizes subscriptions and case, this is not sufficient because a supported resource must change administrative grouping without being recreated, after move prerequisites are validated; the capability addresses a neighboring use case.
Answer D is incorrect because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. The the woodgrove reorganizes subscriptions and case scenario instead requires that a supported resource must change administrative grouping without being recreated, after move prerequisites are validated, so this option would leave the key requirement unresolved.
Question 19
Proseware has six subscriptions that need a shared Azure Policy and RBAC hierarchy. Which Azure construct should sit above the subscriptions? Choose ONE.
- Create a Cost Management budget with alert thresholds
- Create and assign an Azure Policy initiative
- Use an Azure management group above the subscriptions
- Place resources with a common lifecycle in the same resource group
Correct Answer: C
Correct Answer
Answer C is correct because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. In Proseware, this is the best fit because several subscriptions require a common hierarchy for governance above subscription scope.
Incorrect Answers
Answer A is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. Applied to Proseware, this does not provide the required behavior because several subscriptions require a common hierarchy for governance above subscription scope.
Answer B is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. For Proseware, that does not satisfy the requirement that several subscriptions require a common hierarchy for governance above subscription scope; it solves a different administrative need.
Answer D is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. The Proseware scenario instead requires that several subscriptions require a common hierarchy for governance above subscription scope, so this option would leave the key requirement unresolved.
Question 20
Litware wants to organize subscriptions by business unit and apply governance above each set. What should it configure? Choose ONE.
- Create and assign an Azure Policy initiative
- Create a Cost Management budget with alert thresholds
- Place resources with a common lifecycle in the same resource group
- Use an Azure management group above the subscriptions
Correct Answer: D
Correct Answer
Answer D is correct because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. The Litware scenario specifically requires that several subscriptions require a common hierarchy for governance above subscription scope, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. Applied to Litware, this does not provide the required behavior because several subscriptions require a common hierarchy for governance above subscription scope.
Answer B is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. For Litware, that does not satisfy the requirement that several subscriptions require a common hierarchy for governance above subscription scope; it solves a different administrative need.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. In Litware, this is not sufficient because several subscriptions require a common hierarchy for governance above subscription scope; the capability addresses a neighboring use case.
