Examkin

Question

Difficulty: MediumAzure Subscription Management and Cost Control

An administrator manages an Azure subscription that contains two resource groups: `RG-Shared-Services` (which hosts core virtual networks) and `RG-Dev-Test` (which hosts development virtual machines).

The administrator must implement the following controls:
1. Prevent the accidental deletion of any resources within `RG-Shared-Services`.
2. Automatically trigger a script to deallocate virtual machines in `RG-Dev-Test` when the subscription's monthly spend reaches $8,000\$8,000.
3. Allow a junior analyst named User1 to view cost analysis reports for the entire subscription, while ensuring they cannot view or modify the configuration of the virtual machines or network resources.

To achieve this, the administrator applies a CanNotDelete resource lock to `RG-Shared-Services`, configures an Azure Cost Management budget for the subscription with a $8,000\$8,000 limit and a 100%100\% threshold alert without an action group, and assigns the Billing Reader role to User1 at the `RG-Dev-Test` resource group scope.

Which of the following adjustments must be made to fully satisfy all requirements?

  1. A
    Change the resource lock on `RG-Shared-Services` to a ReadOnly lock, and associate an Action Group containing the deallocation script with the budget alert threshold.
  2. Associate an Action Group containing the deallocation script with the budget alert threshold, and assign the Billing Reader role to User1 at the subscription scope.Answer
  3. C
    Assign the Billing Reader role to User1 at the resource group scope for both `RG-Shared-Services` and `RG-Dev-Test`, and configure a budget at the `RG-Dev-Test` scope.
  4. D
    Configure the budget alert threshold to send an email to User1, and assign the Reader role to User1 at the subscription scope.

Answer

Associate an Action Group containing the deallocation script with the budget alert threshold, and assign the Billing Reader role to User1 at the subscription scope.
To automate resource actions when a budget threshold is crossed, the budget alert must be associated with an Action Group that targets an automation resource (like a Logic App or Automation Runbook). To allow User1 to view subscription-wide cost analysis without viewing resource configurations, the Billing Reader role must be assigned at the subscription scope. Assigning the role at the resource group scope limits their view to that specific group, failing the requirement.

Step-by-Step Solution

1
Evaluate the automation requirement for budget alerts.
Identify that budget alerts require association with an Action Group (which can trigger Automation Runbooks or Logic Apps) to execute scripts automatically.
Default budget alerts only send notifications and do not execute scripts unless an Action Group is configured.
2
Evaluate access requirements and scope for User1.
Determine that the Billing Reader role must be assigned at the subscription scope, not the resource group scope.
Assigning Billing Reader at the resource group scope limits cost visibility to that specific resource group, whereas subscription-wide cost analysis requires the assignment to be at the subscription level. The Billing Reader role is correct as it restricts access to resource configurations.
3
Verify lock requirements.
Confirm that a CanNotDelete lock on the shared services resource group is correct because it prevents deletion while allowing write modifications.
Changing the lock to ReadOnly would block standard updates to networking configurations, violating operational needs.

Key Concept

Azure Cost Management scopes, budgets, action groups, and billing RBAC roles.
Rate this question

Topics

Azure Subscription Management and Cost Control

More questions from this topic