Examkin

Question

Difficulty: HardManagement Groups Hierarchies

Aether Health System uses Azure Management Groups to govern their subscriptions. The hierarchy and governance configurations are structured as follows:

* Tenant Root Group
* Aether-Core-MG (Management Group)
* Clinical-Prod-MG (Management Group)
* Subscription A
* Research-Dev-MG (Management Group)
* Subscription B
* Lab-RG (Resource Group)

The following configurations are applied:
* Azure Policy: A policy restricting allowed resource locations to `East US` (Effect: Deny) is assigned to Aether-Core-MG. A policy restricting allowed resource locations to `East US 2` (Effect: Deny) is assigned to Research-Dev-MG.
* Role Assignments: User1 is assigned the Contributor role at Aether-Core-MG. User2 is assigned the Owner role at Clinical-Prod-MG and the Reader role at Research-Dev-MG.
* Locks: A `CanNotDelete` resource lock is applied directly to Lab-RG.

Which of the following statements regarding governance, resource actions, and subscription movement are correct? (Select TWO)

  1. A virtual machine deployment in Subscription B in the East US 2 region will fail because Azure Policy assignments are cumulative, requiring compliance with both the East US and East US 2 restrictions.Answer
  2. User2 cannot move Subscription B to Clinical-Prod-MG unless they are also granted write permissions on the source management group (Research-Dev-MG) or directly on Subscription B.Answer
  3. C
    The location policy assigned to Research-Dev-MG overrides the policy at Aether-Core-MG, allowing resources in Subscription B to be deployed in East US 2 without a policy violation.
  4. D
    User1 can delete any resource in Lab-RG because their Contributor role is inherited from Aether-Core-MG, which bypasses the local CanNotDelete resource lock.
  5. E
    User2 can move Subscription B to Clinical-Prod-MG immediately because their Owner role on the target management group automatically grants permissions over the source subscription.

Answer

A virtual machine deployment in Subscription B in the East US 2 region will fail due to cumulative policy inheritance, and User2 cannot move Subscription B without write permissions on the source management group.
Azure Policy is evaluated cumulatively down the hierarchy, meaning a child scope must satisfy both parent and child policy constraints simultaneously. This restricts Subscription B from deploying resources to either region because they are mutually exclusive. Additionally, moving a subscription requires write access at both the source and target management groups, meaning the user must be granted write access at the source group since they currently only possess Reader permissions there.

Step-by-Step Solution

1
Analyze Azure Policy inheritance down the management group hierarchy.
Effective allowed locations for Subscription B must satisfy both the East US restriction from the parent and the East US 2 restriction from the child.
Azure Policy uses a cumulative evaluation model; child policies do not override parent policies.
2
Evaluate the permissions required for moving a subscription.
Moving Subscription B requires write permissions at the target management group (Clinical-Prod-MG), the source management group (Research-Dev-MG), and the subscription itself.
Since User2 only has Reader access on the source group, they lack the necessary write permissions to execute the subscription move.
3
Evaluate the interaction of RBAC roles and resource locks.
User1 cannot delete resources in Lab-RG despite having the inherited Contributor role.
Resource locks of type CanNotDelete prevent deletion by all users, including those with Contributor or Owner permissions, until the lock is removed.

Key Concept

Azure Management Groups facilitate hierarchical governance where Policies and RBAC roles inherit downward cumulatively, while subscription moves require write permissions at both the source and destination scopes.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic