Microsoft AZ-305 Practice Test 21
Question 200
An architecture proposal for resource group lifecycle and locks relies on the following approach: Place unrelated shared network foundations in the app's ephemeral resource group. Which specific failure or mismatch should the design reviewer identify?
- Disabling policy hides risk rather than fixing the resource state.
- Higher RBAC privileges do not bypass resource locks.
- Tags provide metadata and do not stop DELETE operations.
- Deleting the app group could delete shared platform dependencies.
Explanation
Correct Answer
D:Place unrelated shared network foundations in the app's ephemeral resource group. Deleting the app group could delete shared platform dependencies.
Incorrect Answers
A:This concern applies to Turn off evaluation to make the compliance percentage green. in another design governance design. The current proposal specifically fails because deleting the app group could delete shared platform dependencies.
B:That assessment refers to the separate proposal 'Reassign Owner repeatedly without inspecting lock or policy inheritance.' not to the recommendation under review. Here, Deleting the app group could delete shared platform dependencies.
C:That assessment refers to the separate proposal 'Rely on tags alone to prevent deletion.' not to the recommendation under review. Here, Deleting the app group could delete shared platform dependencies.
Question 201
Acceptance testing must establish the following operational result: The test confirms only intended app resources share lifecycle fate. Which verification action most directly establishes that outcome?
- Open a failed resource evaluation and inspect its field and reason.
- Trace the effective locks and policy evaluation for one rejected request.
- Attempt a controlled delete while the lock is enabled.
- Run a nonproduction deletion plan and review dependency inventory.
Explanation
Correct Answer
D:The test confirms only intended app resources share lifecycle fate.
Incorrect Answers
A:This is a test for A policy assignment shows noncompliance but administrators cannot identify offending resources. The requirement here is instead demonstrated by run a nonproduction deletion plan and review dependency inventory.
B:That verification addresses the different requirement: A resource team reports that write operations fail after an organization-wide policy hardening change. It does not directly establish the test confirms only intended app resources share lifecycle fate.
C:That verification addresses the different requirement: A database resource must not be deleted accidentally by otherwise authorized operators. It does not directly establish the test confirms only intended app resources share lifecycle fate.
Question 202
A database resource must not be deleted accidentally by otherwise authorized operators. Which Azure architecture choice best meets this requirement?
- Apply a CanNotDelete resource lock at the appropriate scope.
- Reassign Owner repeatedly without inspecting lock or policy inheritance.
- Rely on tags alone to prevent deletion.
- Place unrelated shared network foundations in the app's ephemeral resource group.
Explanation
Correct Answer
A:A delete lock blocks supported deletion operations independently of the user's RBAC grant.
Incorrect Answers
B:Higher RBAC privileges do not bypass resource locks. In the present requirement, a database resource must not be deleted accidentally by otherwise authorized operators. The needed design instead works because a delete lock blocks supported deletion operations independently of the user's RBAC grant.
C:Tags provide metadata and do not stop DELETE operations. This proposal contradicts the stated architecture constraint.
D:Deleting the app group could delete shared platform dependencies. In the present requirement, a database resource must not be deleted accidentally by otherwise authorized operators. The needed design instead works because a delete lock blocks supported deletion operations independently of the user's RBAC grant.
Question 203
An architecture proposal for resource group lifecycle and locks relies on the following approach: Rely on tags alone to prevent deletion. Which specific failure or mismatch should the design reviewer identify?
- Separate quotas require independent evaluation or quota adjustments.
- Higher RBAC privileges do not bypass resource locks.
- Deleting the app group could delete shared platform dependencies.
- Tags provide metadata and do not stop DELETE operations.
Explanation
Correct Answer
D:Rely on tags alone to prevent deletion. Tags provide metadata and do not stop DELETE operations.
Incorrect Answers
A:This concern applies to Assume resources can borrow regional quotas from other subscriptions without planning. in another design governance design. The current proposal specifically fails because tags provide metadata and do not stop DELETE operations.
B:That assessment refers to the separate proposal 'Reassign Owner repeatedly without inspecting lock or policy inheritance.' not to the recommendation under review. Here, Tags provide metadata and do not stop DELETE operations.
C:That assessment refers to the separate proposal 'Place unrelated shared network foundations in the app's ephemeral resource group.' not to the recommendation under review. Here, Tags provide metadata and do not stop DELETE operations.
Question 204
Acceptance testing must establish the following operational result: Denial confirms lock enforcement at the targeted resource. Which verification action most directly establishes that outcome?
- Trace the effective locks and policy evaluation for one rejected request.
- Attempt a controlled delete while the lock is enabled.
- Run a nonproduction deletion plan and review dependency inventory.
- Query the specific subscription and region for remaining quotas.
Explanation
Correct Answer
B:Denial confirms lock enforcement at the targeted resource.
Incorrect Answers
A:That verification addresses the different requirement: A resource team reports that write operations fail after an organization-wide policy hardening change. It does not directly establish denial confirms lock enforcement at the targeted resource.
C:That verification addresses the different requirement: A distributed app has resources deployed and removed as one lifecycle unit. It does not directly establish denial confirms lock enforcement at the targeted resource.
D:This is a test for A new workload crosses a subscription quota despite unused capacity in a sister subscription. The requirement here is instead demonstrated by attempt a controlled delete while the lock is enabled.
Question 205
A resource team reports that write operations fail after an organization-wide policy hardening change. Which Azure architecture choice best meets this requirement?
- Reassign Owner repeatedly without inspecting lock or policy inheritance.
- Check inherited ReadOnly locks and policy deny effects at the target scope.
- Place unrelated shared network foundations in the app's ephemeral resource group.
- Rely on tags alone to prevent deletion.
Explanation
Correct Answer
B:Locks can restrict management operations even for role-authorized administrators.
Incorrect Answers
A:Higher RBAC privileges do not bypass resource locks. This proposal contradicts the stated architecture constraint.
C:Deleting the app group could delete shared platform dependencies. In the present requirement, a resource team reports that write operations fail after an organization-wide policy hardening change. The needed design instead works because locks can restrict management operations even for role-authorized administrators.
D:Tags provide metadata and do not stop DELETE operations. In the present requirement, a resource team reports that write operations fail after an organization-wide policy hardening change. The needed design instead works because locks can restrict management operations even for role-authorized administrators.
Question 206
An architecture proposal for resource group lifecycle and locks relies on the following approach: Reassign Owner repeatedly without inspecting lock or policy inheritance. Which specific failure or mismatch should the design reviewer identify?
- Retrofitting network and identity boundaries later raises migration risk.
- Higher RBAC privileges do not bypass resource locks.
- Tags provide metadata and do not stop DELETE operations.
- Deleting the app group could delete shared platform dependencies.
Explanation
Correct Answer
B:Reassign Owner repeatedly without inspecting lock or policy inheritance. Higher RBAC privileges do not bypass resource locks.
Incorrect Answers
A:This concern applies to Deploy workloads independently and fix governance only after production launch. in another design governance design. The current proposal specifically fails because higher RBAC privileges do not bypass resource locks.
C:That assessment refers to the separate proposal 'Rely on tags alone to prevent deletion.' not to the recommendation under review. Here, Higher RBAC privileges do not bypass resource locks.
D:That assessment refers to the separate proposal 'Place unrelated shared network foundations in the app's ephemeral resource group.' not to the recommendation under review. Here, Higher RBAC privileges do not bypass resource locks.
Question 207
Acceptance testing must establish the following operational result: The audit distinguishes access failure from management-plane governance restrictions. Which verification action most directly establishes that outcome?
- Trace the effective locks and policy evaluation for one rejected request.
- Run a nonproduction deletion plan and review dependency inventory.
- Compare a new workload subscription against the documented landing-zone baseline.
- Attempt a controlled delete while the lock is enabled.
Explanation
Correct Answer
A:The audit distinguishes access failure from management-plane governance restrictions.
Incorrect Answers
B:That verification addresses the different requirement: A distributed app has resources deployed and removed as one lifecycle unit. It does not directly establish the audit distinguishes access failure from management-plane governance restrictions.
C:This is a test for An enterprise has inconsistent subscriptions and no shared security or network baseline. The requirement here is instead demonstrated by trace the effective locks and policy evaluation for one rejected request.
D:That verification addresses the different requirement: A database resource must not be deleted accidentally by otherwise authorized operators. It does not directly establish the audit distinguishes access failure from management-plane governance restrictions.
Question 208
A governance team needs storage accounts created privately, mandatory environment tags and monitoring extensions installed on existing VMs. Which THREE policy approaches fit? (Select THREE.)
- Use a supported modify effect to populate mandatory tags on eligible resources.
- Expect an audit-only policy to automatically install VM extensions.
- Use deployIfNotExists and authorized remediation to add eligible VM monitoring dependencies.
- Use only a cost budget alert to prevent public network endpoints.
- Disable all policy compliance reporting to avoid noncompliant findings.
- Use an Azure Policy deny effect to reject noncompliant public-network storage configurations.
Explanation
Correct Answers
A:Modify can update supported metadata during policy enforcement.
C:Remediation can deploy missing dependent extensions.
F:Deny blocks forbidden create or update requests.
Incorrect Answers
B:Audit reports noncompliance but does not deploy resources.
D:Budget signals do not constrain resource configuration.
E:Suppressing visibility does not establish compliance.
Question 209
An architecture proposal for azure policy effects and remediation relies on the following approach: Use a cost budget alert as the only network restriction. Which specific failure or mismatch should the design reviewer identify?
- Deny blocks requests instead of writing approved tag values.
- Budget alerts do not prevent public endpoint configuration.
- An editable note alone cannot prove who applied a resource change.
- Audit marks noncompliance but does not remediate it.
Explanation
Correct Answer
B:Use a cost budget alert as the only network restriction. Budget alerts do not prevent public endpoint configuration.
Incorrect Answers
A:That assessment refers to the separate proposal 'Assign a deny-only policy and expect it to append the missing tag.' not to the recommendation under review. Here, Budget alerts do not prevent public endpoint configuration.
C:This concern applies to Rely on a manually edited wiki page as the only compliance audit record. in another design governance design. The current proposal specifically fails because budget alerts do not prevent public endpoint configuration.
D:That assessment refers to the separate proposal 'Assume an audit-only policy retroactively deploys the missing agent.' not to the recommendation under review. Here, Budget alerts do not prevent public endpoint configuration.
Question 210
Acceptance testing must establish the following operational result: The rejected deployment validates the deny effect. Which verification action most directly establishes that outcome?
- Correlate a controlled policy deployment commit with Activity Log and compliance evaluation.
- Deploy a resource without the tag and inspect the resulting metadata.
- Run remediation and inspect resulting VM agent associations.
- Try creating a deliberately noncompliant storage account in a test subscription.
Explanation
Correct Answer
D:The rejected deployment validates the deny effect.
Incorrect Answers
A:This is a test for A company needs immutable evidence that governance configuration changed after an incident. The requirement here is instead demonstrated by try creating a deliberately noncompliant storage account in a test subscription.
B:That verification addresses the different requirement: An architect wants to add mandatory environment tags to new resources automatically. It does not directly establish the rejected deployment validates the deny effect.
C:That verification addresses the different requirement: A fleet already contains VMs missing required monitoring agent configuration. It does not directly establish the rejected deployment validates the deny effect.