Topic 03 Practice Test 1 covers Azure Subscriptions and Governance for Microsoft Azure Administrator AZ-104 and maps to the objective: Manage Azure subscriptions and governance. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Contoso must prevent deployment of resources outside approved Azure regions. Which Azure Policy effect should enforce the requirement? Choose ONE.
- Use an Azure Policy definition with the Deny effect
- Use an Azure Policy definition with an Audit effect
- Create and assign an Azure Policy initiative
- Use an Azure Policy definition with the Modify effect
Correct Answer: A
Correct Answer
Answer A is correct because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. The Contoso scenario specifically requires that new resources that violate the allowed-location rule must be blocked at deployment time, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to Contoso, this does not provide the required behavior because new resources that violate the allowed-location rule must be blocked at deployment time.
Answer C is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. In Contoso, this is not sufficient because new resources that violate the allowed-location rule must be blocked at deployment time; the capability addresses a neighboring use case.
Answer D is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. For Contoso, that does not satisfy the requirement that new resources that violate the allowed-location rule must be blocked at deployment time; it solves a different administrative need.
Question 2
Fabrikam has finished testing its location rule and now wants noncompliant resource creation rejected. Which policy effect should it use? Choose ONE.
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with the Deny effect
- Create and assign an Azure Policy initiative
- Use an Azure Policy definition with an Audit effect
Correct Answer: B
Correct Answer
Answer B is correct because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. Applied to Fabrikam, the capability meets the requirement that new resources that violate the allowed-location rule must be blocked at deployment time without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. In Fabrikam, this is not sufficient because new resources that violate the allowed-location rule must be blocked at deployment time; the capability addresses a neighboring use case.
Answer C is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. For Fabrikam, that does not satisfy the requirement that new resources that violate the allowed-location rule must be blocked at deployment time; it solves a different administrative need.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The Fabrikam scenario instead requires that new resources that violate the allowed-location rule must be blocked at deployment time, so this option would leave the key requirement unresolved.
Question 3
Northwind wants to inventory resources that violate a naming rule without blocking deployments. Which Azure Policy effect is appropriate? Choose ONE.
- Create an Azure Policy remediation task
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with an Audit effect
- Use an Azure Policy definition with the Deny effect
Correct Answer: C
Correct Answer
Answer C is correct because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. For the northwind wants to inventory case, that directly satisfies the requirement that the organization wants visibility into noncompliance before enforcing or changing resources.
Incorrect Answers
Answer A is incorrect because A remediation task brings eligible existing noncompliant resources toward compliance for effects such as Modify or DeployIfNotExists. Applied to the northwind wants to inventory case, this does not provide the required behavior because the organization wants visibility into noncompliance before enforcing or changing resources.
Answer B is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. The the northwind wants to inventory case scenario instead requires that the organization wants visibility into noncompliance before enforcing or changing resources, so this option would leave the key requirement unresolved.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. In the northwind wants to inventory case, this is not sufficient because the organization wants visibility into noncompliance before enforcing or changing resources; the capability addresses a neighboring use case.
Question 4
Adventure Works is assessing the impact of a new governance rule and wants noncompliant resources reported only. Which effect should it start with? Choose ONE.
- Use an Azure Policy definition with the Deny effect
- Create an Azure Policy remediation task
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with an Audit effect
Correct Answer: D
Correct Answer
Answer D is correct because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. In Adventure Works, this is the best fit because the organization wants visibility into noncompliance before enforcing or changing resources.
Incorrect Answers
Answer A is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. For Adventure Works, that does not satisfy the requirement that the organization wants visibility into noncompliance before enforcing or changing resources; it solves a different administrative need.
Answer B is incorrect because A remediation task brings eligible existing noncompliant resources toward compliance for effects such as Modify or DeployIfNotExists. The Adventure Works scenario instead requires that the organization wants visibility into noncompliance before enforcing or changing resources, so this option would leave the key requirement unresolved.
Answer C is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. Applied to Adventure Works, this does not provide the required behavior because the organization wants visibility into noncompliance before enforcing or changing resources.
Question 5
Tailspin wants Azure Policy to add a required CostCenter tag when supported resource requests omit it. Which effect is designed for this behavior? Choose ONE.
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with an Audit effect
- Use DeployIfNotExists with the required remediation configuration
- Use an Azure Policy definition with the Deny effect
Correct Answer: A
Correct Answer
Answer A is correct because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. The the tailspin wants azure policy case scenario specifically requires that a supported tag or property should be adjusted automatically during compliant resource requests, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to the tailspin wants azure policy case, this does not provide the required behavior because a supported tag or property should be adjusted automatically during compliant resource requests.
Answer C is incorrect because DeployIfNotExists can deploy a related configuration when a required resource or setting is missing, commonly paired with remediation for existing resources. In the tailspin wants azure policy case, this is not sufficient because a supported tag or property should be adjusted automatically during compliant resource requests; the capability addresses a neighboring use case.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. For the tailspin wants azure policy case, that does not satisfy the requirement that a supported tag or property should be adjusted automatically during compliant resource requests; it solves a different administrative need.
Question 6
Woodgrove wants a policy to correct a supported tag value during create or update rather than merely report the issue. Which effect should it evaluate? Choose ONE.
- Use DeployIfNotExists with the required remediation configuration
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with the Deny effect
- Use an Azure Policy definition with an Audit effect
Correct Answer: B
Correct Answer
Answer B is correct because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. Applied to the woodgrove wants a policy case, the capability meets the requirement that a supported tag or property should be adjusted automatically during compliant resource requests without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because DeployIfNotExists can deploy a related configuration when a required resource or setting is missing, commonly paired with remediation for existing resources. For the woodgrove wants a policy case, that does not satisfy the requirement that a supported tag or property should be adjusted automatically during compliant resource requests; it solves a different administrative need.
Answer C is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. In the woodgrove wants a policy case, this is not sufficient because a supported tag or property should be adjusted automatically during compliant resource requests; the capability addresses a neighboring use case.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The the woodgrove wants a policy case scenario instead requires that a supported tag or property should be adjusted automatically during compliant resource requests, so this option would leave the key requirement unresolved.
Question 7
Proseware requires diagnostic settings on resources and wants Azure Policy to deploy the missing related configuration. Which effect fits? Choose ONE.
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with an Audit effect
- Use DeployIfNotExists with the required remediation configuration
- Create a Cost Management budget with alert thresholds
Correct Answer: C
Correct Answer
Answer C is correct because DeployIfNotExists can deploy a related configuration when a required resource or setting is missing, commonly paired with remediation for existing resources. For Proseware, that directly satisfies the requirement that a related configuration resource should be deployed automatically when it is missing.
Incorrect Answers
Answer A is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. In Proseware, this is not sufficient because a related configuration resource should be deployed automatically when it is missing; the capability addresses a neighboring use case.
Answer B is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The Proseware scenario instead requires that a related configuration resource should be deployed automatically when it is missing, so this option would leave the key requirement unresolved.
Answer D is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. Applied to Proseware, this does not provide the required behavior because a related configuration resource should be deployed automatically when it is missing.
Question 8
Litware wants a policy assignment to create a required monitoring configuration when a compliant resource lacks it. Which effect is most appropriate? Choose ONE.
- Create a Cost Management budget with alert thresholds
- Use an Azure Policy definition with the Modify effect
- Use an Azure Policy definition with an Audit effect
- Use DeployIfNotExists with the required remediation configuration
Correct Answer: D
Correct Answer
Answer D is correct because DeployIfNotExists can deploy a related configuration when a required resource or setting is missing, commonly paired with remediation for existing resources. In Litware, this is the best fit because a related configuration resource should be deployed automatically when it is missing.
Incorrect Answers
Answer A is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. The Litware scenario instead requires that a related configuration resource should be deployed automatically when it is missing, so this option would leave the key requirement unresolved.
Answer B is incorrect because Modify can add, update, or remove supported resource properties or tags during requests when the policy rule and role requirements are satisfied. For Litware, that does not satisfy the requirement that a related configuration resource should be deployed automatically when it is missing; it solves a different administrative need.
Answer C is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to Litware, this does not provide the required behavior because a related configuration resource should be deployed automatically when it is missing.
Question 9
Wingtip assigns a Modify policy, but hundreds of existing resources remain noncompliant. What should the administrator create to process those resources? Choose ONE.
- Create an Azure Policy remediation task
- Use an Azure Policy definition with an Audit effect
- Exclude the approved child scope by using notScopes on the policy assignment
- Apply the required tag directly to the target resource
Correct Answer: A
Correct Answer
Answer A is correct because A remediation task brings eligible existing noncompliant resources toward compliance for effects such as Modify or DeployIfNotExists. The the wingtip assigns a modify case scenario specifically requires that existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to the wingtip assigns a modify case, this does not provide the required behavior because existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned.
Answer C is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. For the wingtip assigns a modify case, that does not satisfy the requirement that existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned; it solves a different administrative need.
Answer D is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. In the wingtip assigns a modify case, this is not sufficient because existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned; the capability addresses a neighboring use case.
Question 10
- Datum applies DeployIfNotExists and wants existing resources evaluated and corrected, not only future deployments. What should it run? Choose ONE.
- Apply the required tag directly to the target resource
- Create an Azure Policy remediation task
- Use an Azure Policy definition with an Audit effect
- Exclude the approved child scope by using notScopes on the policy assignment
Correct Answer: B
Correct Answer
Answer B is correct because A remediation task brings eligible existing noncompliant resources toward compliance for effects such as Modify or DeployIfNotExists. Applied to A. Datum, the capability meets the requirement that existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. For A. Datum, that does not satisfy the requirement that existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned; it solves a different administrative need.
Answer C is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The A. Datum scenario instead requires that existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned, so this option would leave the key requirement unresolved.
Answer D is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. In A. Datum, this is not sufficient because existing resources need to be brought into compliance after a Modify or DeployIfNotExists policy is assigned; the capability addresses a neighboring use case.
Question 11
Contoso has eight security policy definitions that belong to one baseline. What should it create to manage them together? Choose ONE.
- Exclude the approved child scope by using notScopes on the policy assignment
- Use an Azure management group above the subscriptions
- Create and assign an Azure Policy initiative
- Use an Azure Policy definition with the Deny effect
Correct Answer: C
Correct Answer
Answer C is correct because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. For Contoso, that directly satisfies the requirement that multiple policy definitions with one governance goal should be assigned and tracked as a single unit.
Incorrect Answers
Answer A is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. Applied to Contoso, this does not provide the required behavior because multiple policy definitions with one governance goal should be assigned and tracked as a single unit.
Answer B is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. The Contoso scenario instead requires that multiple policy definitions with one governance goal should be assigned and tracked as a single unit, so this option would leave the key requirement unresolved.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. In Contoso, this is not sufficient because multiple policy definitions with one governance goal should be assigned and tracked as a single unit; the capability addresses a neighboring use case.
Question 12
Fabrikam wants one assignment that contains several related policy definitions for a compliance standard. Which Azure Policy object should it use? Choose ONE.
- Use an Azure management group above the subscriptions
- Exclude the approved child scope by using notScopes on the policy assignment
- Use an Azure Policy definition with the Deny effect
- Create and assign an Azure Policy initiative
Correct Answer: D
Correct Answer
Answer D is correct because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. In Fabrikam, this is the best fit because multiple policy definitions with one governance goal should be assigned and tracked as a single unit.
Incorrect Answers
Answer A is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. Applied to Fabrikam, this does not provide the required behavior because multiple policy definitions with one governance goal should be assigned and tracked as a single unit.
Answer B is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. The Fabrikam scenario instead requires that multiple policy definitions with one governance goal should be assigned and tracked as a single unit, so this option would leave the key requirement unresolved.
Answer C is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. For Fabrikam, that does not satisfy the requirement that multiple policy definitions with one governance goal should be assigned and tracked as a single unit; it solves a different administrative need.
Question 13
Northwind assigns a policy to a subscription but must exclude RG-Lab from the assignment entirely. Which assignment setting should it use? Choose ONE.
- Exclude the approved child scope by using notScopes on the policy assignment
- Create a policy exemption for the approved resource or hierarchy
- Use an Azure management group above the subscriptions
- Use an Azure Policy definition with an Audit effect
Correct Answer: A
Correct Answer
Answer A is correct because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. The the northwind assigns a policy case scenario specifically requires that one approved child scope should not be evaluated by an otherwise broad policy assignment, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because A policy exemption keeps the assignment relationship visible while documenting that a resource is exempt, optionally with category and expiration. Applied to the northwind assigns a policy case, this does not provide the required behavior because one approved child scope should not be evaluated by an otherwise broad policy assignment.
Answer C is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. In the northwind assigns a policy case, this is not sufficient because one approved child scope should not be evaluated by an otherwise broad policy assignment; the capability addresses a neighboring use case.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. For the northwind assigns a policy case, that does not satisfy the requirement that one approved child scope should not be evaluated by an otherwise broad policy assignment; it solves a different administrative need.
Question 14
Adventure Works has one sandbox resource group that should sit outside a subscription-level policy assignment. What should the administrator configure? Choose ONE.
- Use an Azure management group above the subscriptions
- Exclude the approved child scope by using notScopes on the policy assignment
- Create a policy exemption for the approved resource or hierarchy
- Use an Azure Policy definition with an Audit effect
Correct Answer: B
Correct Answer
Answer B is correct because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. Applied to Adventure Works, the capability meets the requirement that one approved child scope should not be evaluated by an otherwise broad policy assignment without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. For Adventure Works, that does not satisfy the requirement that one approved child scope should not be evaluated by an otherwise broad policy assignment; it solves a different administrative need.
Answer C is incorrect because A policy exemption keeps the assignment relationship visible while documenting that a resource is exempt, optionally with category and expiration. The Adventure Works scenario instead requires that one approved child scope should not be evaluated by an otherwise broad policy assignment, so this option would leave the key requirement unresolved.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. In Adventure Works, this is not sufficient because one approved child scope should not be evaluated by an otherwise broad policy assignment; the capability addresses a neighboring use case.
Question 15
A DeployIfNotExists policy has just been assigned and existing resources are missing the required configuration. Which TWO actions are central to correcting the existing estate? Choose TWO.
- Use an Azure Policy definition with an Audit effect
- Use DeployIfNotExists with the required remediation configuration
- Create a Cost Management budget with alert thresholds
- Apply the required tag directly to the target resource
- Create an Azure Policy remediation task
Correct Answers: B, E
Correct Answers
Answer B is correct because DeployIfNotExists can deploy a related configuration when a required resource or setting is missing, commonly paired with remediation for existing resources. For the a deployifnotexists policy has case, that directly satisfies the requirement that the policy must define the deployment behavior and a remediation task must process existing noncompliant resources.
Answer E is correct because A remediation task brings eligible existing noncompliant resources toward compliance for effects such as Modify or DeployIfNotExists. In the a deployifnotexists policy has case, this is the best fit because the policy must define the deployment behavior and a remediation task must process existing noncompliant resources.
Incorrect Answers
Answer A is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The the a deployifnotexists policy has case scenario instead requires that the policy must define the deployment behavior and a remediation task must process existing noncompliant resources, so this option would leave the key requirement unresolved.
Answer C is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. Applied to the a deployifnotexists policy has case, this does not provide the required behavior because the policy must define the deployment behavior and a remediation task must process existing noncompliant resources.
Answer D is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. For the a deployifnotexists policy has case, that does not satisfy the requirement that the policy must define the deployment behavior and a remediation task must process existing noncompliant resources; it solves a different administrative need.
Question 16
Tailspin accepts a temporary compliance exception for one resource and wants the exception documented with an expiration date. What should it create? Choose ONE.
- Exclude the approved child scope by using notScopes on the policy assignment
- Use an Azure Policy definition with an Audit effect
- Apply the required tag directly to the target resource
- Create a policy exemption for the approved resource or hierarchy
Correct Answer: D
Correct Answer
Answer D is correct because A policy exemption keeps the assignment relationship visible while documenting that a resource is exempt, optionally with category and expiration. In the tailspin accepts a temporary case, this is the best fit because the resource should remain associated with the assignment but have a documented, reviewable exception.
Incorrect Answers
Answer A is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. The the tailspin accepts a temporary case scenario instead requires that the resource should remain associated with the assignment but have a documented, reviewable exception, so this option would leave the key requirement unresolved.
Answer B is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to the tailspin accepts a temporary case, this does not provide the required behavior because the resource should remain associated with the assignment but have a documented, reviewable exception.
Answer C is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. For the tailspin accepts a temporary case, that does not satisfy the requirement that the resource should remain associated with the assignment but have a documented, reviewable exception; it solves a different administrative need.
Question 17
Woodgrove needs to record that a resource is intentionally exempt from one definition in an initiative while retaining governance visibility. Which object fits? Choose ONE.
- Create a policy exemption for the approved resource or hierarchy
- Apply the required tag directly to the target resource
- Use an Azure Policy definition with an Audit effect
- Exclude the approved child scope by using notScopes on the policy assignment
Correct Answer: A
Correct Answer
Answer A is correct because A policy exemption keeps the assignment relationship visible while documenting that a resource is exempt, optionally with category and expiration. The the woodgrove needs to record case scenario specifically requires that the resource should remain associated with the assignment but have a documented, reviewable exception, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because A tag is a key-value metadata pair on the resource itself; tagging a parent resource group does not automatically copy the tag to children. Applied to the woodgrove needs to record case, this does not provide the required behavior because the resource should remain associated with the assignment but have a documented, reviewable exception.
Answer C is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. For the woodgrove needs to record case, that does not satisfy the requirement that the resource should remain associated with the assignment but have a documented, reviewable exception; it solves a different administrative need.
Answer D is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. In the woodgrove needs to record case, this is not sufficient because the resource should remain associated with the assignment but have a documented, reviewable exception; the capability addresses a neighboring use case.
Question 18
Proseware has a production storage account that administrators may modify but must not delete accidentally. Which lock level should it use? Choose ONE.
- Apply a ReadOnly resource lock
- Apply a CanNotDelete resource lock
- Apply the lock at the parent resource group or subscription scope
- Use an Azure Policy definition with the Deny effect
Correct Answer: B
Correct Answer
Answer B is correct because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. Applied to Proseware, the capability meets the requirement that authorized users may change the resource but accidental deletion must be blocked without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. For Proseware, that does not satisfy the requirement that authorized users may change the resource but accidental deletion must be blocked; it solves a different administrative need.
Answer C is incorrect because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. The Proseware scenario instead requires that authorized users may change the resource but accidental deletion must be blocked, so this option would leave the key requirement unresolved.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. In Proseware, this is not sufficient because authorized users may change the resource but accidental deletion must be blocked; the capability addresses a neighboring use case.
Question 19
Litware wants configuration changes to remain possible on a resource group while preventing deletion of the group and its protected resources. Which lock is appropriate? Choose ONE.
- Apply a ReadOnly resource lock
- Use an Azure Policy definition with the Deny effect
- Apply a CanNotDelete resource lock
- Apply the lock at the parent resource group or subscription scope
Correct Answer: C
Correct Answer
Answer C is correct because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. For Litware, that directly satisfies the requirement that authorized users may change the resource but accidental deletion must be blocked.
Incorrect Answers
Answer A is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. Applied to Litware, this does not provide the required behavior because authorized users may change the resource but accidental deletion must be blocked.
Answer B is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. The Litware scenario instead requires that authorized users may change the resource but accidental deletion must be blocked, so this option would leave the key requirement unresolved.
Answer D is incorrect because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. In Litware, this is not sufficient because authorized users may change the resource but accidental deletion must be blocked; the capability addresses a neighboring use case.
Question 20
Wingtip freezes a production resource for an audit and wants to block all control-plane changes, not just deletion. Which lock level should be applied? Choose ONE.
- Grant or use permissions that include Microsoft.Authorization/locks/* to manage the lock
- Apply a CanNotDelete resource lock
- Use an Azure Policy definition with an Audit effect
- Apply a ReadOnly resource lock
Correct Answer: D
Correct Answer
Answer D is correct because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. In the wingtip freezes a production case, this is the best fit because control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible.
Incorrect Answers
Answer A is incorrect because Creating or deleting a management lock requires lock-management permissions; ordinary resource write permissions are not sufficient. For the wingtip freezes a production case, that does not satisfy the requirement that control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible; it solves a different administrative need.
Answer B is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. The the wingtip freezes a production case scenario instead requires that control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible, so this option would leave the key requirement unresolved.
Answer C is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to the wingtip freezes a production case, this does not provide the required behavior because control-plane modifications, including operations implemented as POST, must be blocked while reads remain possible.
