Topic 03 Practice Test 3 covers Azure Subscriptions and Governance for Microsoft Azure Administrator AZ-104 and maps to the objective: Manage Azure subscriptions and governance. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Wingtip needs one Reader role assignment to apply across all subscriptions beneath MG-Shared. Where should it assign the role? Choose ONE.
- Assign the policy or Azure role at the management-group scope
- Use an Azure Policy definition with an Audit effect
- Place resources with a common lifecycle in the same resource group
- Use an Azure management group above the subscriptions
Correct Answer: A
Correct Answer
Answer A is correct because Assignments at a management group are inherited by child subscriptions and descendant scopes, providing consistent governance across them. For the wingtip needs one reader case, that directly satisfies the requirement that one assignment should flow from the management-group hierarchy to child subscriptions and resources.
Incorrect Answers
Answer B is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. Applied to the wingtip needs one reader case, this does not provide the required behavior because one assignment should flow from the management-group hierarchy to child subscriptions and resources.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. The the wingtip needs one reader case scenario instead requires that one assignment should flow from the management-group hierarchy to child subscriptions and resources, so this option would leave the key requirement unresolved.
Answer D is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. In the wingtip needs one reader case, this is not sufficient because one assignment should flow from the management-group hierarchy to child subscriptions and resources; the capability addresses a neighboring use case.
Question 2
- Datum wants an Azure Policy baseline inherited by every subscription under a management group. At which scope should the policy be assigned? Choose ONE.
- Use an Azure management group above the subscriptions
- Assign the policy or Azure role at the management-group scope
- Place resources with a common lifecycle in the same resource group
- Use an Azure Policy definition with an Audit effect
Correct Answer: B
Correct Answer
Answer B is correct because Assignments at a management group are inherited by child subscriptions and descendant scopes, providing consistent governance across them. In A. Datum, this is the best fit because one assignment should flow from the management-group hierarchy to child subscriptions and resources.
Incorrect Answers
Answer A is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. For A. Datum, that does not satisfy the requirement that one assignment should flow from the management-group hierarchy to child subscriptions and resources; it solves a different administrative need.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. Applied to A. Datum, this does not provide the required behavior because one assignment should flow from the management-group hierarchy to child subscriptions and resources.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The A. Datum scenario instead requires that one assignment should flow from the management-group hierarchy to child subscriptions and resources, so this option would leave the key requirement unresolved.
Question 3
Contoso restructures its management-group hierarchy and moves Subscription-A under MG-Production. What hierarchy rule should the administrator account for? Choose ONE.
- Use an Azure management group above the subscriptions
- Place resources with a common lifecycle in the same resource group
- Place the subscription under the intended single parent management group
- Create and assign an Azure Policy initiative
Correct Answer: C
Correct Answer
Answer C is correct because A subscription participates in the management-group hierarchy under one parent management group at a time. The Contoso scenario specifically requires that the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. Applied to Contoso, this does not provide the required behavior because the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents.
Answer B is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. For Contoso, that does not satisfy the requirement that the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents; it solves a different administrative need.
Answer D is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. In Contoso, this is not sufficient because the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents; the capability addresses a neighboring use case.
Question 4
Fabrikam is diagramming management groups and asks whether one subscription can simultaneously have two parent management groups. Which design is valid? Choose ONE.
- Use an Azure management group above the subscriptions
- Create and assign an Azure Policy initiative
- Place resources with a common lifecycle in the same resource group
- Place the subscription under the intended single parent management group
Correct Answer: D
Correct Answer
Answer D is correct because A subscription participates in the management-group hierarchy under one parent management group at a time. Applied to Fabrikam, the capability meets the requirement that the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. The Fabrikam scenario instead requires that the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents, so this option would leave the key requirement unresolved.
Answer B is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. For Fabrikam, that does not satisfy the requirement that the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents; it solves a different administrative need.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. In Fabrikam, this is not sufficient because the subscription must be placed at the correct point in the management-group tree without multiple simultaneous parents; the capability addresses a neighboring use case.
Question 5
A company wants governance across many subscriptions and a documented exception for one resource. Which TWO Azure constructs best fit? Choose TWO.
- Place resources with a common lifecycle in the same resource group
- Use an Azure management group above the subscriptions
- Exclude the approved child scope by using notScopes on the policy assignment
- Create a Cost Management budget with alert thresholds
- Create a policy exemption for the approved resource or hierarchy
Correct Answers: B, E
Correct Answers
Answer B is correct because Management groups provide hierarchical governance above subscriptions so Azure Policy and Azure RBAC can be inherited by multiple subscriptions. For the a company wants governance case, that directly satisfies the requirement that management groups provide cross-subscription hierarchy and policy exemptions document approved exceptions.
Answer E is correct because A policy exemption keeps the assignment relationship visible while documenting that a resource is exempt, optionally with category and expiration. In the a company wants governance case, this is the best fit because management groups provide cross-subscription hierarchy and policy exemptions document approved exceptions.
Incorrect Answers
Answer A is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. The the a company wants governance case scenario instead requires that management groups provide cross-subscription hierarchy and policy exemptions document approved exceptions, so this option would leave the key requirement unresolved.
Answer C is incorrect because notScopes removes specified child scopes from an assignment so those resources are not evaluated by that assignment. Applied to the a company wants governance case, this does not provide the required behavior because management groups provide cross-subscription hierarchy and policy exemptions document approved exceptions.
Answer D is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. For the a company wants governance case, that does not satisfy the requirement that management groups provide cross-subscription hierarchy and policy exemptions document approved exceptions; it solves a different administrative need.
Question 6
Northwind wants email notifications when monthly Azure cost reaches 80% and 100% of a target. Which Cost Management feature should it configure? Choose ONE.
- Use an Azure Policy definition with the Deny effect
- Create a Cost Management budget with alert thresholds
- Review Azure Advisor cost recommendations
- Configure Cost Management alerts or budget notifications for the required scope
Correct Answer: B
Correct Answer
Answer B is correct because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. In the northwind wants email notifications case, this is the best fit because the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically.
Incorrect Answers
Answer A is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. For the northwind wants email notifications case, that does not satisfy the requirement that the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically; it solves a different administrative need.
Answer C is incorrect because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. Applied to the northwind wants email notifications case, this does not provide the required behavior because the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically.
Answer D is incorrect because Cost Management alerting provides notification when configured cost conditions or budget thresholds are reached; it is monitoring rather than an enforcement stop. The the northwind wants email notifications case scenario instead requires that the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically, so this option would leave the key requirement unresolved.
Question 7
Adventure Works wants to track spend against a monthly target and alert stakeholders at several percentages. What should it create? Choose ONE.
- Configure Cost Management alerts or budget notifications for the required scope
- Review Azure Advisor cost recommendations
- Create a Cost Management budget with alert thresholds
- Use an Azure Policy definition with the Deny effect
Correct Answer: C
Correct Answer
Answer C is correct because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. The Adventure Works scenario specifically requires that the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Cost Management alerting provides notification when configured cost conditions or budget thresholds are reached; it is monitoring rather than an enforcement stop. In Adventure Works, this is not sufficient because the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically; the capability addresses a neighboring use case.
Answer B is incorrect because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. For Adventure Works, that does not satisfy the requirement that the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically; it solves a different administrative need.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. Applied to Adventure Works, this does not provide the required behavior because the team needs threshold notifications for cost tracking and understands that spending will not be stopped automatically.
Question 8
Tailspin wants recommendations that identify potential cost savings in deployed Azure resources. Which service should it review? Choose ONE.
- Create a Cost Management budget with alert thresholds
- Configure Cost Management alerts or budget notifications for the required scope
- Use an Azure Policy definition with an Audit effect
- Review Azure Advisor cost recommendations
Correct Answer: D
Correct Answer
Answer D is correct because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. Applied to the tailspin wants recommendations that case, the capability meets the requirement that the administrator needs Azure-generated recommendations for reducing or optimizing resource cost without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. For the tailspin wants recommendations that case, that does not satisfy the requirement that the administrator needs Azure-generated recommendations for reducing or optimizing resource cost; it solves a different administrative need.
Answer B is incorrect because Cost Management alerting provides notification when configured cost conditions or budget thresholds are reached; it is monitoring rather than an enforcement stop. In the tailspin wants recommendations that case, this is not sufficient because the administrator needs Azure-generated recommendations for reducing or optimizing resource cost; the capability addresses a neighboring use case.
Answer C is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The the tailspin wants recommendations that case scenario instead requires that the administrator needs Azure-generated recommendations for reducing or optimizing resource cost, so this option would leave the key requirement unresolved.
Question 9
Woodgrove asks for optimization guidance such as right-sizing opportunities rather than only threshold alerts. Which Azure feature best fits? Choose ONE.
- Review Azure Advisor cost recommendations
- Create a Cost Management budget with alert thresholds
- Configure Cost Management alerts or budget notifications for the required scope
- Use an Azure Policy definition with an Audit effect
Correct Answer: A
Correct Answer
Answer A is correct because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. For the woodgrove asks for optimization case, that directly satisfies the requirement that the administrator needs Azure-generated recommendations for reducing or optimizing resource cost.
Incorrect Answers
Answer B is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. Applied to the woodgrove asks for optimization case, this does not provide the required behavior because the administrator needs Azure-generated recommendations for reducing or optimizing resource cost.
Answer C is incorrect because Cost Management alerting provides notification when configured cost conditions or budget thresholds are reached; it is monitoring rather than an enforcement stop. The the woodgrove asks for optimization case scenario instead requires that the administrator needs Azure-generated recommendations for reducing or optimizing resource cost, so this option would leave the key requirement unresolved.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. In the woodgrove asks for optimization case, this is not sufficient because the administrator needs Azure-generated recommendations for reducing or optimizing resource cost; the capability addresses a neighboring use case.
Question 10
Proseware needs administrators notified when a defined cost condition occurs. It does not want workloads stopped automatically. Which capability should it configure? Choose ONE.
- Use an Azure Policy definition with the Deny effect
- Configure Cost Management alerts or budget notifications for the required scope
- Review Azure Advisor cost recommendations
- Create a Cost Management budget with alert thresholds
Correct Answer: B
Correct Answer
Answer B is correct because Cost Management alerting provides notification when configured cost conditions or budget thresholds are reached; it is monitoring rather than an enforcement stop. In Proseware, this is the best fit because the requirement is notification about a cost condition rather than automatic shutdown or access denial.
Incorrect Answers
Answer A is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. For Proseware, that does not satisfy the requirement that the requirement is notification about a cost condition rather than automatic shutdown or access denial; it solves a different administrative need.
Answer C is incorrect because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. Applied to Proseware, this does not provide the required behavior because the requirement is notification about a cost condition rather than automatic shutdown or access denial.
Answer D is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. The Proseware scenario instead requires that the requirement is notification about a cost condition rather than automatic shutdown or access denial, so this option would leave the key requirement unresolved.
Question 11
Litware wants cost-related notifications for a scoped set of Azure charges without implementing a policy that blocks deployments. Which feature should it use? Choose ONE.
- Review Azure Advisor cost recommendations
- Use an Azure Policy definition with the Deny effect
- Configure Cost Management alerts or budget notifications for the required scope
- Create a Cost Management budget with alert thresholds
Correct Answer: C
Correct Answer
Answer C is correct because Cost Management alerting provides notification when configured cost conditions or budget thresholds are reached; it is monitoring rather than an enforcement stop. The Litware scenario specifically requires that the requirement is notification about a cost condition rather than automatic shutdown or access denial, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. For Litware, that does not satisfy the requirement that the requirement is notification about a cost condition rather than automatic shutdown or access denial; it solves a different administrative need.
Answer B is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. Applied to Litware, this does not provide the required behavior because the requirement is notification about a cost condition rather than automatic shutdown or access denial.
Answer D is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. In Litware, this is not sufficient because the requirement is notification about a cost condition rather than automatic shutdown or access denial; the capability addresses a neighboring use case.
Question 12
Wingtip wants to enforce allowed regions and separately control which engineers can create resources. Which governance model correctly separates these needs? Choose ONE.
- Create a Cost Management budget with alert thresholds
- Create and assign an Azure Policy initiative
- Use an Azure Policy definition with the Deny effect
- Use Azure Policy for compliance and Azure RBAC separately for authorization
Correct Answer: D
Correct Answer
Answer D is correct because Azure Policy evaluates resource compliance and can enforce resource rules, while Azure RBAC grants principals permission to perform Azure actions. Applied to the wingtip wants to enforce case, the capability meets the requirement that the design must distinguish resource compliance rules from permissions granted to identities without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. In the wingtip wants to enforce case, this is not sufficient because the design must distinguish resource compliance rules from permissions granted to identities; the capability addresses a neighboring use case.
Answer B is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. The the wingtip wants to enforce case scenario instead requires that the design must distinguish resource compliance rules from permissions granted to identities, so this option would leave the key requirement unresolved.
Answer C is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. For the wingtip wants to enforce case, that does not satisfy the requirement that the design must distinguish resource compliance rules from permissions granted to identities; it solves a different administrative need.
Question 13
- Datum is troubleshooting a design that expects Azure Policy to grant a user permission to deploy resources. What should it use for authorization instead? Choose ONE.
- Use Azure Policy for compliance and Azure RBAC separately for authorization
- Create and assign an Azure Policy initiative
- Use an Azure Policy definition with the Deny effect
- Create a Cost Management budget with alert thresholds
Correct Answer: A
Correct Answer
Answer A is correct because Azure Policy evaluates resource compliance and can enforce resource rules, while Azure RBAC grants principals permission to perform Azure actions. For A. Datum, that directly satisfies the requirement that the design must distinguish resource compliance rules from permissions granted to identities.
Incorrect Answers
Answer B is incorrect because An initiative groups multiple policy definitions under one governance objective so they can be assigned and tracked together. In A. Datum, this is not sufficient because the design must distinguish resource compliance rules from permissions granted to identities; the capability addresses a neighboring use case.
Answer C is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. Applied to A. Datum, this does not provide the required behavior because the design must distinguish resource compliance rules from permissions granted to identities.
Answer D is incorrect because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. The A. Datum scenario instead requires that the design must distinguish resource compliance rules from permissions granted to identities, so this option would leave the key requirement unresolved.
Question 14
Contoso delegates lock administration through a custom role. Which permission family must the role include? Choose ONE.
- Remove the management lock before performing the blocked operation
- Grant or use permissions that include Microsoft.Authorization/locks/* to manage the lock
- Apply a CanNotDelete resource lock
- Use an Azure Policy definition with an Audit effect
Correct Answer: B
Correct Answer
Answer B is correct because Creating or deleting a management lock requires lock-management permissions; ordinary resource write permissions are not sufficient. In Contoso, this is the best fit because the administrator must have explicit management-lock permissions before creating or deleting locks.
Incorrect Answers
Answer A is incorrect because Management locks apply even to highly privileged users; the lock must be removed by an identity with lock-management permission before the protected operation can proceed. For Contoso, that does not satisfy the requirement that the administrator must have explicit management-lock permissions before creating or deleting locks; it solves a different administrative need.
Answer C is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. Applied to Contoso, this does not provide the required behavior because the administrator must have explicit management-lock permissions before creating or deleting locks.
Answer D is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. The Contoso scenario instead requires that the administrator must have explicit management-lock permissions before creating or deleting locks, so this option would leave the key requirement unresolved.
Question 15
Fabrikam gives an operator resource-write access, but the operator still cannot remove a management lock. What additional capability is required? Choose ONE.
- Use an Azure Policy definition with an Audit effect
- Apply a CanNotDelete resource lock
- Grant or use permissions that include Microsoft.Authorization/locks/* to manage the lock
- Remove the management lock before performing the blocked operation
Correct Answer: C
Correct Answer
Answer C is correct because Creating or deleting a management lock requires lock-management permissions; ordinary resource write permissions are not sufficient. The Fabrikam scenario specifically requires that the administrator must have explicit management-lock permissions before creating or deleting locks, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Audit records noncompliance without blocking the resource operation, making it useful for assessing impact before enforcement. In Fabrikam, this is not sufficient because the administrator must have explicit management-lock permissions before creating or deleting locks; the capability addresses a neighboring use case.
Answer B is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. For Fabrikam, that does not satisfy the requirement that the administrator must have explicit management-lock permissions before creating or deleting locks; it solves a different administrative need.
Answer D is incorrect because Management locks apply even to highly privileged users; the lock must be removed by an identity with lock-management permission before the protected operation can proceed. Applied to Fabrikam, this does not provide the required behavior because the administrator must have explicit management-lock permissions before creating or deleting locks.
Question 16
Northwind tries to apply a CanNotDelete lock directly to a management group. What should the administrator do instead? Choose ONE.
- Apply the lock at the parent resource group or subscription scope
- Apply a ReadOnly resource lock
- Apply a CanNotDelete resource lock
- Apply locks at subscription, resource-group, or resource scope instead of management-group scope
Correct Answer: D
Correct Answer
Answer D is correct because Azure management locks can protect subscriptions, resource groups, or resources; management groups themselves do not support management locks. Applied to the northwind tries to apply case, the capability meets the requirement that the organization needs a supported lock scope because management groups themselves cannot receive management locks without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. For the northwind tries to apply case, that does not satisfy the requirement that the organization needs a supported lock scope because management groups themselves cannot receive management locks; it solves a different administrative need.
Answer B is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. In the northwind tries to apply case, this is not sufficient because the organization needs a supported lock scope because management groups themselves cannot receive management locks; the capability addresses a neighboring use case.
Answer C is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. The the northwind tries to apply case scenario instead requires that the organization needs a supported lock scope because management groups themselves cannot receive management locks, so this option would leave the key requirement unresolved.
Question 17
Adventure Works wants deletion protection above several resources but attempts to configure a lock at management-group scope. Which correction is required? Choose ONE.
- Apply locks at subscription, resource-group, or resource scope instead of management-group scope
- Apply a CanNotDelete resource lock
- Apply a ReadOnly resource lock
- Apply the lock at the parent resource group or subscription scope
Correct Answer: A
Correct Answer
Answer A is correct because Azure management locks can protect subscriptions, resource groups, or resources; management groups themselves do not support management locks. For Adventure Works, that directly satisfies the requirement that the organization needs a supported lock scope because management groups themselves cannot receive management locks.
Incorrect Answers
Answer B is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. In Adventure Works, this is not sufficient because the organization needs a supported lock scope because management groups themselves cannot receive management locks; the capability addresses a neighboring use case.
Answer C is incorrect because A ReadOnly lock permits reads but blocks control-plane write operations, including many actions implemented as POST requests. The Adventure Works scenario instead requires that the organization needs a supported lock scope because management groups themselves cannot receive management locks, so this option would leave the key requirement unresolved.
Answer D is incorrect because Locks applied at a parent scope are inherited by child resources, so one parent lock can protect the contained resources. Applied to Adventure Works, this does not provide the required behavior because the organization needs a supported lock scope because management groups themselves cannot receive management locks.
Question 18
Tailspin asks whether one VM can simultaneously belong to RG-App and RG-Shared. Which resource-group rule applies? Choose ONE.
- Use the supported Azure resource move operation after validating move prerequisites
- Keep each resource in exactly one resource group at a time
- Place resources with a common lifecycle in the same resource group
- Keep the resources in separate resource groups and allow them to communicate as required
Correct Answer: B
Correct Answer
Answer B is correct because An Azure resource belongs to one resource group at a time, even though it can interact with resources located in other resource groups. In the tailspin asks whether one case, this is the best fit because the resource must have a single current resource-group membership even though it may communicate across groups.
Incorrect Answers
Answer A is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. Applied to the tailspin asks whether one case, this does not provide the required behavior because the resource must have a single current resource-group membership even though it may communicate across groups.
Answer C is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. For the tailspin asks whether one case, that does not satisfy the requirement that the resource must have a single current resource-group membership even though it may communicate across groups; it solves a different administrative need.
Answer D is incorrect because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. The the tailspin asks whether one case scenario instead requires that the resource must have a single current resource-group membership even though it may communicate across groups, so this option would leave the key requirement unresolved.
Question 19
Woodgrove is reorganizing resources and wants one storage account shown as a member of two resource groups at once. What should the administrator explain? Choose ONE.
- Keep the resources in separate resource groups and allow them to communicate as required
- Place resources with a common lifecycle in the same resource group
- Keep each resource in exactly one resource group at a time
- Use the supported Azure resource move operation after validating move prerequisites
Correct Answer: C
Correct Answer
Answer C is correct because An Azure resource belongs to one resource group at a time, even though it can interact with resources located in other resource groups. The the woodgrove is reorganizing resources case scenario specifically requires that the resource must have a single current resource-group membership even though it may communicate across groups, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Azure resources can interact across resource groups; a resource group does not create a network or communication boundary. In the woodgrove is reorganizing resources case, this is not sufficient because the resource must have a single current resource-group membership even though it may communicate across groups; the capability addresses a neighboring use case.
Answer B is incorrect because A resource group is a management container for related Azure resources and is commonly aligned to resources that share lifecycle and administration. Applied to the woodgrove is reorganizing resources case, this does not provide the required behavior because the resource must have a single current resource-group membership even though it may communicate across groups.
Answer D is incorrect because Many Azure resource types can move between resource groups or subscriptions, but supported-resource and dependency constraints must be checked before the move. For the woodgrove is reorganizing resources case, that does not satisfy the requirement that the resource must have a single current resource-group membership even though it may communicate across groups; it solves a different administrative need.
Question 20
A cost-governance team wants proactive notifications and optimization guidance without automatically shutting down workloads. Which TWO features should it use? Choose TWO.
- Apply a CanNotDelete resource lock
- Create a Cost Management budget with alert thresholds
- Delete the resource group only when all contained resources should also be removed
- Use an Azure Policy definition with the Deny effect
- Review Azure Advisor cost recommendations
Correct Answers: B, E
Correct Answers
Answer B is correct because Budgets track cost or usage against a target and can trigger alerts at thresholds, but they do not automatically stop resources or spending. Applied to the a cost-governance team wants case, the capability meets the requirement that budgets provide threshold alerting and Azure Advisor provides optimization recommendations without adding unrelated scope.
Answer E is correct because Azure Advisor analyzes deployed resources and can surface cost recommendations such as right-sizing or identifying optimization opportunities. For the a cost-governance team wants case, that directly satisfies the requirement that budgets provide threshold alerting and Azure Advisor provides optimization recommendations.
Incorrect Answers
Answer A is incorrect because A CanNotDelete lock allows authorized modifications but prevents deletion until the lock is removed by someone with lock-management permission. The the a cost-governance team wants case scenario instead requires that budgets provide threshold alerting and Azure Advisor provides optimization recommendations, so this option would leave the key requirement unresolved.
Answer C is incorrect because Deleting a resource group initiates deletion of the resources contained in that group, so it is a lifecycle operation rather than a simple folder deletion. Applied to the a cost-governance team wants case, this does not provide the required behavior because budgets provide threshold alerting and Azure Advisor provides optimization recommendations.
Answer D is incorrect because A Deny policy blocks creation or update of resources that do not satisfy the policy rule, which is appropriate for enforced guardrails. In the a cost-governance team wants case, this is not sufficient because budgets provide threshold alerting and Azure Advisor provides optimization recommendations; the capability addresses a neighboring use case.
