Describe Azure Management and Governance practice questions

Answer: A) Cost Management exports and APIs

Microsoft Cost Management offers APIs, such as Exports and Cost Details, that deliver cost and usage data to other systems automatically. The pricing calculator, Azure Advisor and Service Health do not provide actual cost records.

• ACorrect. Cost Management offers APIs for working with cost data programmatically. For example, the Exports API sets up recurring daily, weekly or monthly exports of cost details to Azure Storage, and the Cost Details API generates cost data on demand. These records can feed custom dashboards and reporting systems.
• BIncorrect. The pricing calculator estimates the cost of resources you plan to deploy. It does not provide the actual usage and charge records of an existing subscription.
• CIncorrect. Azure Advisor gives recommendations, such as resizing or shutting down underused resources, to reduce spending. It is not a way to get detailed daily cost records into another system.
• DIncorrect. Azure Service Health reports Azure service incidents, planned maintenance and health advisories that affect your resources. It does not provide billing or usage data.

Answer: A) Contributor

• AThe Contributor role allows full management of resources — creating, modifying, and deleting them — within its assigned scope, but deliberately excludes the ability to grant access to other users, distinguishing it from the more privileged Owner role which includes that access-management capability.
• BOwner includes everything Contributor does, plus the ability to grant access to other users — more permission than this scenario specifically wants to grant.
• CReader can only view resources, with no ability to create, modify, or delete them, less permission than this scenario needs for someone doing daily hands-on resource work.
• DA management group is a governance hierarchy construct, not an RBAC role that can be assigned to a person.

Answer: A) The Azure mobile app

The Azure mobile app lets administrators monitor resources, receive alerts, and run common operations such as restarting a VM from an iOS or Android device.

• ACorrect. The Azure mobile app for iOS and Android lets you view resource status and health, receive alerts and push notifications, and perform common operations such as starting, stopping, or restarting virtual machines.
• BIncorrect. Azure Advisor analyzes your configuration and gives best-practice recommendations. It is not an app for responding to alerts or restarting resources from a phone.
• CIncorrect. Service Health reports Azure platform incidents, planned maintenance, and advisories that affect your services. It does not let you manage or restart your own VM from a phone.
• DIncorrect. Azure Arc extends Azure management to resources running on-premises or in other clouds. It is not a mobile app for responding to alerts.

Answer: A) Azure Update Manager

• AAzure Update Manager provides centralized visibility into update/patch compliance across a fleet of VMs, showing which machines are missing critical updates and letting an administrator manage and schedule patching centrally, rather than checking and patching each VM individually.
• BA resource lock prevents deletion/modification of a resource; it has no patch compliance tracking function.
• CAzure DNS handles domain name resolution, entirely unrelated to patch compliance tracking.
• DA management group organizes subscriptions for governance; it isn't the specific tool for tracking VM patch compliance.

Answer: A) Azure PowerShell (the Az module)

Azure PowerShell brings PowerShell's object-based cmdlet model to Azure: its Az cmdlets return .NET objects that you can pipe and inspect. That makes it the natural choice for an administrator who already scripts with PowerShell.

• ACorrect. The Az module is a set of PowerShell modules whose cmdlets call Azure Resource Manager and return .NET objects. Those objects can be piped and inspected with Get-Member, just like the administrator's existing cmdlets.
• BIncorrect. Azure CLI is a cross-platform command-line tool for managing Azure, but it uses 'az' commands with text/JSON output. It is not the PowerShell cmdlet and .NET object model the administrator already uses.
• CIncorrect. ARM templates are declarative JSON files that describe the desired resources. They are not an interactive, cmdlet-based scripting environment.
• DIncorrect. The Azure portal is a web-based graphical interface, not a scripting tool built on cmdlets and object pipelines.

Answer: A) Each resource supports up to 50 tag name-value pairs; to store more values, combine several of them into a JSON string in one tag value

An Azure resource, resource group, or subscription can have at most 50 tag name-value pairs. If you need more, you can store several values as a JSON string in one tag. Resources don't inherit tags, and management groups can't be tagged.

• ACorrect. Each resource, resource group, and subscription can have at most 50 tag name-value pairs. Microsoft documents using a JSON string as a tag value when you need to store more values than that.
• BIncorrect. Resources don't inherit tags from their resource group or subscription. To copy tags down to resources, you must use Azure Policy.
• CIncorrect. You can tag resources, resource groups, and subscriptions, but not management groups. Tags also aren't inherited.
• DIncorrect. 512 is the maximum length of a tag name in characters, not the number of tags allowed. The per-resource maximum is 50 tag name-value pairs.

Answer: A) Application Insights

Application Insights is the APM feature of Azure Monitor. It collects request, response-time, failure, and dependency telemetry from your app through an SDK or agent, and it supports availability tests.

• ACorrect. Application Insights is the application performance monitoring (APM) feature of Azure Monitor. You enable it with an SDK or agent. It tracks request rates, response times, failure rates, and dependency calls, and it can run availability tests that send synthetic requests to the app.
• BIncorrect. Log Analytics is the tool in the Azure portal for writing and running queries against data Azure Monitor has already collected. It doesn't instrument an application or run availability tests.
• CIncorrect. Alerts notify you when a condition you defined is met, using alert rules and action groups. They act on monitoring data but don't collect application performance telemetry from your code.
• DIncorrect. Azure Service Health reports on the health of Azure services and regions, such as outages and planned maintenance. It doesn't measure how your own application code performs.

Answer: A) Many resource types can be moved to another resource group or to another subscription

Many Azure resources can be moved between resource groups or subscriptions without being redeployed. A move changes the resource ID but not the region, and some resource types don't support moving.

• ACorrect. Azure Resource Manager can move resources between resource groups in the same subscription or across subscriptions in the same Microsoft Entra tenant. Not every resource type supports moving, so check the list of supported resource types before you start.
• BIncorrect. The move operation changes a resource's resource group without deleting it. Existing resources keep running during the move.
• CIncorrect. You can move resources between resource groups in the same subscription and also across subscriptions.
• DIncorrect. A move only changes the resource group the resource belongs to (and so its resource ID). It doesn't change the resource's physical region. To change regions, use a separate tool such as Azure Resource Mover.

Answer: A) Deny

• AThe Deny effect actively blocks the creation of a non-compliant resource, stopping the deployment outright at the time it's attempted — a stricter enforcement than the Audit effect, which merely logs the violation for review while still allowing the resource to be created.
• BAudit logs a non-compliant resource for review but still allows it to be created, less strict than the deployment-blocking behavior being described in this scenario, which is Deny.
• CA resource lock prevents deletion/modification of an already-existing resource; it isn't an Azure Policy effect applied at resource creation time.
• DA budget alert notifies about spending thresholds; it has no relationship to blocking non-compliant resource deployments.

Answer: A) An Azure Policy with the deny effect that checks the tag value against an approved list

Azure Policy can check tag values as well as whether a tag exists. A rule that uses 'in' or 'notIn' on tags['environment'] with the deny effect rejects any value outside the approved list.

• ACorrect. Azure Policy rules can evaluate tags['environment'] with conditions such as 'in' and 'notIn' against a list of allowed values. With the deny effect, requests with a missing tag or a value outside the list are rejected.
• BIncorrect. An 'exists' condition makes sure the tag is present, but it accepts any value. It doesn't meet the requirement to reject values outside the approved list.
• CIncorrect. A resource lock prevents modification or deletion of existing resources. It can't check tag values on new deployments.
• DIncorrect. The modify effect adds or changes tags on resources, but it doesn't reject requests that already carry a value outside the approved list.