Examkin

Question

Difficulty: MediumAzure Subscription Management and Cost Control

You manage an Azure environment containing a management group named `MG-Dev`. The management group contains two subscriptions: `Sub-Dev-01` and `Sub-Dev-02`.

You need to implement a cost control strategy to meet the following requirements:
1. Monitor combined spending across both subscriptions and notify the engineering lead via email if the combined monthly cost exceeds 50005{}000 USD.
2. Automatically stop all virtual machines (VMs) in a resource group named `rg-temp-resources` in `Sub-Dev-01` if the monthly cost of that resource group exceeds 10001{}000 USD.

You perform the following configurations:
- Create a budget named `Budget-MG` at the `MG-Dev` scope with a limit of 50005{}000 USD and add the engineering lead's email to the alert threshold.
- Create a budget named `Budget-Temp` at the `rg-temp-resources` scope with a limit of 10001{}000 USD, and configure an action group that triggers an Azure Automation runbook to stop the VMs.
- Apply a `ReadOnly` lock to the `rg-temp-resources` resource group.

Which of the following describes the outcome of this configuration when the budget thresholds are exceeded?

  1. A
    The email notification is not sent because management group budgets do not support email alerts, but the virtual machines in `rg-temp-resources` are successfully stopped.
  2. B
    The email notification is successfully sent, and the virtual machines in `rg-temp-resources` are successfully stopped because resource locks do not block automated operations executed by Azure Automation runbooks.
  3. The email notification is successfully sent, but the virtual machines in `rg-temp-resources` are not stopped because the `ReadOnly` lock inherits to the virtual machines and prevents the runbook from modifying their power state.Answer
  4. D
    The email notification is not sent because the Azure Automation runbook inherits a Deny assignment from the management group scope that blocks all alerts.

Answer

The email notification is successfully sent, but the virtual machines in `rg-temp-resources` are not stopped because the `ReadOnly` lock inherits to the virtual machines and prevents the runbook from modifying their power state.
The budget configured at the management group scope successfully sends email notifications because management group budgets support direct email alerts. However, the ReadOnly lock applied at the resource group scope inherits to all child resources (the virtual machines). Because stopping a virtual machine requires a POST action that modifies the resource state, the ReadOnly lock blocks the Azure Automation runbook from stopping the virtual machines.

Step-by-Step Solution

1
Evaluate the behavior of the budget configured at the management group scope (Budget-MG).
The budget is successfully evaluated, and since email alerts are supported at the management group scope, the email notification is sent to the engineering lead.
Azure Cost Management budgets support scope configurations at the management group level, including email notifications for threshold alerts.
2
Evaluate the inheritance and impact of the ReadOnly lock on `rg-temp-resources`.
The ReadOnly lock inherits to all virtual machines within the resource group, blocking operations that modify resource state, such as stopping or deallocating the VMs.
Azure Resource locks applied at a parent scope (resource group) are inherited by all child resources. A ReadOnly lock blocks all write and write-equivalent POST operations.
3
Determine the outcome when the budget threshold triggers the Azure Automation runbook.
The runbook fails to stop the virtual machines, leaving them running and continuing to accrue costs.
Although the budget alert triggers the runbook, the inherited ReadOnly lock blocks the runbook's API request to stop the VMs.

Key Concept

Azure budgets can be scoped to management groups to aggregate cost data and trigger alerts. Additionally, resource locks are inherited and restrict both manual and automated resource operations, including power state changes on virtual machines.
Estimated Time:1m 30s
Rate this question

Topics

Azure Subscription Management and Cost Control

More questions from this topic