Manage Azure identities and governance practice questions

Answer: A) A spending limit

• ACertain subscription types have a spending limit that disables resources when credits run out.
• BBudgets alert on spend but don't stop resources.
• CAdvisor gives recommendations.
• DManagement groups organize subscriptions.

Answer: A) They're removed and must be recreated

• ARole assignments reference identities in the old tenant, so they don't carry over.
• BIdentities from the old tenant don't exist in the new one.
• CRole assignments aren't converted.
• DAssignments don't move automatically.

Answer: A) Access reviews

• AAccess reviews schedule recurring recertification of group memberships, app assignments, or role assignments; reviewers approve or deny continued access and denied users can be auto-removed.
• BDynamic rules set membership from attributes automatically; they don't drive a human recertification workflow.
• CConditional Access evaluates sign-ins; it isn't a periodic membership attestation process.
• DBudgets track cost, not group membership.

Answer: A) Set 'Access management for Azure resources' to Yes in Microsoft Entra ID properties

Microsoft Entra roles and Azure RBAC are secured independently. A Global Administrator must elevate access, which grants User Access Administrator at root scope, before they can reassign roles on the subscriptions.

• ACorrect. This elevates the Global Administrator's access by assigning them User Access Administrator at root scope (/). They can then view and assign roles in every subscription and management group in the tenant.
• BIncorrect. Without an Azure role assignment, the Global Administrator has no permission to create role assignments on the subscriptions. Entra roles don't grant Azure RBAC rights.
• CIncorrect. Privileged Role Administrator is a Microsoft Entra role. Entra role assignments don't grant access to Azure resources, so this doesn't restore subscription access.
• DIncorrect. Admin consent gives an application delegated permissions. It doesn't create an Azure RBAC role assignment on any subscription.

Answer: A) A policy with the 'Deny' effect on disallowed locations to block new non-compliant deployments, and run a compliance scan to identify existing violations

• AThe Deny effect stops future non-compliant resource creation; Azure Policy then continuously evaluates existing resources and reports them as non-compliant so you can remediate.
• BAudit reports non-compliance but does not prevent new resources being created in the wrong region.
• CRBAC has no location awareness; it can't allow creation in some regions and block it in others. Azure Policy is the right tool.
• DA lock prevents deletion; it does nothing about which regions resources are deployed to.

Answer: A) Restore it from Deleted users

• ADeleted users can be restored within 30 days, keeping their attributes and memberships.
• BA new account loses the original object, memberships and history.
• CSubscription backups don't include Entra users.
• DDeleted users can be restored within the retention window.

Answer: A) Shared

• AA shared scope applies the reservation across eligible subscriptions in the billing context.
• BThat limits the discount to one resource group.
• CReservations apply to matching usage, not one named VM.
• DReservations can be shared.

Answer: A) Access reviews

• AAccess reviews schedule recurring attestation of group, role, or app access so stale access is removed.
• BSSPR lets users reset their own passwords; it has nothing to do with access recertification.
• CMonitor alerts on metrics and logs, not access attestation.
• DLocks protect resources from change, not access recertification.

Answer: A) The devices must be enrolled in and evaluated by Microsoft Intune (or a supported MDM), which reports compliance state to Entra ID

• ACompliance state comes from Intune policy evaluation; without MDM enrollment there is no compliance signal for Conditional Access to check, so all sign-ins would be blocked.
• BOn-premises domain join alone doesn't produce an Intune compliance status (hybrid join + Intune does).
• CLocks are unrelated to device compliance.
• DIP addressing has nothing to do with compliance evaluation.

Answer: A) A policy that inherits the tag from the resource group

• ABuilt-in policies can add or replace a tag on resources using the resource group's value.
• BManual tagging is slow and error-prone.
• CLocks prevent deletion or changes; they don't apply tags.
• DAction groups send notifications; they don't tag resources.