Examkin

Question

Difficulty: HardAzure Subscription Management and Cost Control

An organization has an Azure subscription named `Sub-App-01` that contains three resource groups: `rg-prod-web`, `rg-prod-db`, and `rg-dev-temp`. You need to configure Azure Cost Management, budgets, and governance to meet the following requirements:
- Monitor spending across the entire subscription with a monthly budget of \\ 10{}000 .−Whenthesubscriptionspendingreaches. - When the subscription spending reaches 90\%( (\\90009{}000) of the budget, a webhook must trigger an Azure Logic App to delete all virtual machines in `rg-dev-temp`.
- Prevent accidental deletion of any production resources in `rg-prod-web` and `rg-prod-db` by administrators.
- Ensure the Logic App can successfully delete the virtual machines in `rg-dev-temp` when triggered.

Which two actions should you perform? (Select two.)

  1. A
    Apply a CanNotDelete resource lock directly to the Sub-App-01 subscription.
  2. Apply a CanNotDelete resource lock separately to the rg-prod-web and rg-prod-db resource groups.Answer
  3. Create the monthly budget at the Sub-App-01 subscription scope, configure a 90%90\% threshold alert, and link it to an Action Group configured with a Logic App action.Answer
  4. D
    Create the monthly budget at the Sub-App-01 subscription scope, and configure a budget alert threshold at 90%90\% that only specifies email recipients under the Alert Recipients settings without linking an Action Group.

Answer

Apply a CanNotDelete resource lock separately to the rg-prod-web and rg-prod-db resource groups, and create the monthly budget at the Sub-App-01 subscription scope, configure a 90%90\% threshold alert, and link it to an Action Group configured with a Logic App action.
To satisfy the requirements, the monthly budget must be configured at the subscription scope and linked to an Action Group that contains a Logic App action. This allows the budget threshold alert to successfully trigger the Logic App. Additionally, to protect production resources without blocking the deletion of development resources, the CanNotDelete locks must be applied directly to the individual production resource groups rather than the subscription, preventing lock inheritance from affecting the development resource group.

Step-by-Step Solution

1
Analyze lock scope requirements to prevent production deletions while allowing development deletions.
Realize that applying a lock at the subscription scope (Sub-App-01) inherits to all child groups and blocks the Logic App in the development resource group (rg-dev-temp).
Azure Resource Lock inheritance propagates from parent scopes (subscriptions) to child scopes (resource groups and resources).
2
Determine the correct lock configuration.
Apply CanNotDelete locks separately to the production resource groups (rg-prod-web and rg-prod-db).
This leaves the development resource group (rg-dev-temp) unlocked, allowing the Logic App to perform the deletion task.
3
Analyze budget and automation trigger requirements.
Identify that the budget must be created at the subscription scope to monitor all spending, and that the alert must trigger an Action Group.
Standard email alerts configured directly in the budget settings cannot trigger automated actions like webhooks or Logic Apps. An Action Group is required to invoke a Logic App.

Key Concept

Azure resource lock inheritance and budget alert Action Group integration.
Estimated Time:2m 30s
Rate this question

Topics

Azure Subscription Management and Cost Control

More questions from this topic