Microsoft AZ-305 Practice Test 23
Question 220
A policy assignment shows noncompliance but administrators cannot identify offending resources. Which Azure architecture choice best meets this requirement?
- Turn off evaluation to make the compliance percentage green.
- Use Azure Policy compliance state and resource-level evaluation details.
- Configure one cost alert and label it complete regulatory compliance.
- Delete the baseline policy for the entire management-group hierarchy.
Explanation
Correct Answer
B:Compliance reports identify which resources failed a specific definition.
Incorrect Answers
A:Disabling policy hides risk rather than fixing the resource state. This proposal contradicts the stated architecture constraint.
C:Cost alerts do not evaluate the required security configuration properties. In the present requirement, a policy assignment shows noncompliance but administrators cannot identify offending resources. The needed design instead works because compliance reports identify which resources failed a specific definition.
D:Global removal weakens unrelated compliant projects. In the present requirement, a policy assignment shows noncompliance but administrators cannot identify offending resources. The needed design instead works because compliance reports identify which resources failed a specific definition.
Question 221
An architecture proposal for initiatives and compliance monitoring relies on the following approach: Turn off evaluation to make the compliance percentage green. Which specific failure or mismatch should the design reviewer identify?
- Cost alerts do not evaluate the required security configuration properties.
- Disabling policy hides risk rather than fixing the resource state.
- Uniform root assignment can impose incompatible controls across divisions.
- Global removal weakens unrelated compliant projects.
Explanation
Correct Answer
B:Turn off evaluation to make the compliance percentage green. Disabling policy hides risk rather than fixing the resource state.
Incorrect Answers
A:That assessment refers to the separate proposal 'Configure one cost alert and label it complete regulatory compliance.' not to the recommendation under review. Here, Disabling policy hides risk rather than fixing the resource state.
C:This concern applies to Put all division policies directly on the tenant root with no exceptions model. in another design governance design. The current proposal specifically fails because disabling policy hides risk rather than fixing the resource state.
D:That assessment refers to the separate proposal 'Delete the baseline policy for the entire management-group hierarchy.' not to the recommendation under review. Here, Disabling policy hides risk rather than fixing the resource state.
Question 222
Acceptance testing must establish the following operational result: Detailed state supports a targeted remediation. Which verification action most directly establishes that outcome?
- Open a failed resource evaluation and inspect its field and reason.
- Compare inherited and local assignments at representative child subscriptions.
- Review exemption scope, category, expiration and assignment linkage.
- Inspect per-definition compliance in the initiative report.
Explanation
Correct Answer
A:Detailed state supports a targeted remediation.
Incorrect Answers
B:This is a test for Two business divisions need different policy constraints but a shared central security baseline. The requirement here is instead demonstrated by open a failed resource evaluation and inspect its field and reason.
C:That verification addresses the different requirement: A policy baseline is applied to a new project but legitimate legacy resources need documented exceptions. It does not directly establish detailed state supports a targeted remediation.
D:That verification addresses the different requirement: A regulated subscription must satisfy dozens of coordinated security controls tracked as one baseline. It does not directly establish detailed state supports a targeted remediation.
Question 223
A policy baseline is applied to a new project but legitimate legacy resources need documented exceptions. Which Azure architecture choice best meets this requirement?
- Turn off evaluation to make the compliance percentage green.
- Configure one cost alert and label it complete regulatory compliance.
- Delete the baseline policy for the entire management-group hierarchy.
- Use narrowly scoped Azure Policy exemptions with justification and expiry as appropriate.
Explanation
Correct Answer
D:Explicit exemptions preserve oversight while avoiding broad rule removal.
Incorrect Answers
A:Disabling policy hides risk rather than fixing the resource state. In the present requirement, a policy baseline is applied to a new project but legitimate legacy resources need documented exceptions. The needed design instead works because explicit exemptions preserve oversight while avoiding broad rule removal.
B:Cost alerts do not evaluate the required security configuration properties. In the present requirement, a policy baseline is applied to a new project but legitimate legacy resources need documented exceptions. The needed design instead works because explicit exemptions preserve oversight while avoiding broad rule removal.
C:Global removal weakens unrelated compliant projects. This proposal contradicts the stated architecture constraint.
Question 224
An architecture proposal for initiatives and compliance monitoring relies on the following approach: Delete the baseline policy for the entire management-group hierarchy. Which specific failure or mismatch should the design reviewer identify?
- Global removal weakens unrelated compliant projects.
- Disabling policy hides risk rather than fixing the resource state.
- Permanent global grants defeat just-in-time privileged governance.
- Cost alerts do not evaluate the required security configuration properties.
Explanation
Correct Answer
A:Delete the baseline policy for the entire management-group hierarchy. Global removal weakens unrelated compliant projects.
Incorrect Answers
B:That assessment refers to the separate proposal 'Turn off evaluation to make the compliance percentage green.' not to the recommendation under review. Here, Global removal weakens unrelated compliant projects.
C:This concern applies to Give all team members permanent Global Administrator for convenience. in another design governance design. The current proposal specifically fails because global removal weakens unrelated compliant projects.
D:That assessment refers to the separate proposal 'Configure one cost alert and label it complete regulatory compliance.' not to the recommendation under review. Here, Global removal weakens unrelated compliant projects.
Question 225
Acceptance testing must establish the following operational result: An auditable exception record proves the variance remains bounded. Which verification action most directly establishes that outcome?
- Open a failed resource evaluation and inspect its field and reason.
- Review exemption scope, category, expiration and assignment linkage.
- Review activation records, expiry and justification for one privileged role.
- Inspect per-definition compliance in the initiative report.
Explanation
Correct Answer
B:An auditable exception record proves the variance remains bounded.
Incorrect Answers
A:That verification addresses the different requirement: A policy assignment shows noncompliance but administrators cannot identify offending resources. It does not directly establish an auditable exception record proves the variance remains bounded.
C:This is a test for Teams require eligible privileged roles with forced justification and audit visibility. The requirement here is instead demonstrated by review exemption scope, category, expiration and assignment linkage.
D:That verification addresses the different requirement: A regulated subscription must satisfy dozens of coordinated security controls tracked as one baseline. It does not directly establish an auditable exception record proves the variance remains bounded.
Question 226
Finance needs reliable cost allocation by business unit across several subscriptions. Which Azure architecture choice best meets this requirement?
- Grant everyone Owner and use manual portal browsing as discovery strategy.
- Use a local VM hostname as the only billing dimension.
- Assume Azure always copies every parent tag to all existing descendants.
- Require and populate consistent cost-center tags on eligible resources.
Explanation
Correct Answer
D:Cost reporting can group tagged usage when tag coverage is governed.
Incorrect Answers
A:Broad privilege is unrelated to accurate multi-subscription inventory. In the present requirement, finance needs reliable cost allocation by business unit across several subscriptions. The needed design instead works because cost reporting can group tagged usage when tag coverage is governed.
B:Hostnames do not consistently cover managed services or allocated cloud charges. This proposal contradicts the stated architecture constraint.
C:Unenforced inheritance leaves child resources without billing metadata. In the present requirement, finance needs reliable cost allocation by business unit across several subscriptions. The needed design instead works because cost reporting can group tagged usage when tag coverage is governed.
Question 227
An architecture proposal for cost tagging and resource inventory relies on the following approach: Use a local VM hostname as the only billing dimension. Which specific failure or mismatch should the design reviewer identify?
- Hostnames do not consistently cover managed services or allocated cloud charges.
- Unenforced inheritance leaves child resources without billing metadata.
- Broad privilege is unrelated to accurate multi-subscription inventory.
- Unrecorded review cannot demonstrate periodic recertification.
Explanation
Correct Answer
A:Use a local VM hostname as the only billing dimension. Hostnames do not consistently cover managed services or allocated cloud charges.
Incorrect Answers
B:That assessment refers to the separate proposal 'Assume Azure always copies every parent tag to all existing descendants.' not to the recommendation under review. Here, Hostnames do not consistently cover managed services or allocated cloud charges.
C:That assessment refers to the separate proposal 'Grant everyone Owner and use manual portal browsing as discovery strategy.' not to the recommendation under review. Here, Hostnames do not consistently cover managed services or allocated cloud charges.
D:This concern applies to Request one-time verbal approval with no recorded membership outcome. in another design governance design. The current proposal specifically fails because hostnames do not consistently cover managed services or allocated cloud charges.
Question 228
Acceptance testing must establish the following operational result: Coverage checks expose untagged or misclassified spend. Which verification action most directly establishes that outcome?
- Validate candidate stale resources against actual usage telemetry.
- Inspect an existing child resource before and after remediation.
- Compare cost analysis tag reports to subscription resource inventories.
- Inspect review decisions and the applied membership changes.
Explanation
Correct Answer
C:Coverage checks expose untagged or misclassified spend.
Incorrect Answers
A:That verification addresses the different requirement: A team must identify stale resources after a merger and clean them without changing owners' permissions. It does not directly establish coverage checks expose untagged or misclassified spend.
B:That verification addresses the different requirement: An application owner expects tags set on a resource group to appear automatically on every child. It does not directly establish coverage checks expose untagged or misclassified spend.
D:This is a test for Line managers must periodically attest which employees still need application membership. The requirement here is instead demonstrated by compare cost analysis tag reports to subscription resource inventories.
Question 229
An application owner expects tags set on a resource group to appear automatically on every child. Which Azure architecture choice best meets this requirement?
- Use explicit tag inheritance enforcement through policy where required.
- Use a local VM hostname as the only billing dimension.
- Assume Azure always copies every parent tag to all existing descendants.
- Grant everyone Owner and use manual portal browsing as discovery strategy.
Explanation
Correct Answer
A:Resource-group tags are not automatically propagated to every resource.
Incorrect Answers
B:Hostnames do not consistently cover managed services or allocated cloud charges. In the present requirement, an application owner expects tags set on a resource group to appear automatically on every child. The needed design instead works because resource-group tags are not automatically propagated to every resource.
C:Unenforced inheritance leaves child resources without billing metadata. This proposal contradicts the stated architecture constraint.
D:Broad privilege is unrelated to accurate multi-subscription inventory. In the present requirement, an application owner expects tags set on a resource group to appear automatically on every child. The needed design instead works because resource-group tags are not automatically propagated to every resource.
Question 230
An architecture proposal for cost tagging and resource inventory relies on the following approach: Assume Azure always copies every parent tag to all existing descendants. Which specific failure or mismatch should the design reviewer identify?
- Deny blocks requests instead of writing approved tag values.
- Unenforced inheritance leaves child resources without billing metadata.
- Hostnames do not consistently cover managed services or allocated cloud charges.
- Broad privilege is unrelated to accurate multi-subscription inventory.
Explanation
Correct Answer
B:Assume Azure always copies every parent tag to all existing descendants. Unenforced inheritance leaves child resources without billing metadata.
Incorrect Answers
A:This concern applies to Assign a deny-only policy and expect it to append the missing tag. in another design governance design. The current proposal specifically fails because unenforced inheritance leaves child resources without billing metadata.
C:That assessment refers to the separate proposal 'Use a local VM hostname as the only billing dimension.' not to the recommendation under review. Here, Unenforced inheritance leaves child resources without billing metadata.
D:That assessment refers to the separate proposal 'Grant everyone Owner and use manual portal browsing as discovery strategy.' not to the recommendation under review. Here, Unenforced inheritance leaves child resources without billing metadata.