Examkin

Question

Difficulty: Very hardAzure Advisor

An organization's operations team is designing a governance framework for their Azure environment. They need to meet the following three requirements:

1. Receive proactive best-practice recommendations regarding resource manageability, such as identifying existing workloads that lack tags or resource locks.
2. Prevent any user, including administrators, from accidentally deleting critical production virtual machines while still allowing the virtual machines to be started, stopped, and updated.
3. Ensure that all newly created resources automatically receive specific resource tags at the time of deployment.

Which combination of Azure features or services should the team use to meet these requirements?

  1. A
    Azure Monitor for recommendations, Azure Role-Based Access Control (RBAC) to prevent deletion, and Azure Policy to enforce tags on new resources
  2. B
    Azure Policy for recommendations, Delete (CanNotDelete) resource locks to prevent deletion, and automatic tag inheritance from containing resource groups
  3. Azure Advisor for recommendations, Delete (CanNotDelete) resource locks to prevent deletion, and Azure Policy to enforce tags on new resourcesAnswer
  4. D
    Azure Advisor for recommendations, ReadOnly resource locks to prevent deletion, and Azure Policy to enforce tags on new resources

Answer

Azure Advisor for recommendations, Delete (CanNotDelete) resource locks to prevent deletion, and Azure Policy to enforce tags on new resources
The correct option correctly identifies Azure Advisor for providing governance and manageability best practices, a Delete lock to block deletion while keeping the virtual machine operational, and Azure Policy to automate tag enforcement during deployment.

Step-by-Step Solution

1
Identify the service that provides proactive governance best-practice recommendations.
Azure Advisor provides recommendations across five categories (including Operational Excellence, which covers tags and locks).
This matches the first requirement of identifying resources lacking tags or locks.
2
Determine the correct type of lock to prevent deletion without blocking updates or power states.
A Delete (CanNotDelete) resource lock allows starting, stopping, and updating resources, but blocks deletion.
This satisfies the second requirement, whereas a ReadOnly lock would block normal operations.
3
Identify the governance service that automatically enforces compliance rules during resource deployment.
Azure Policy can evaluate resource properties during deployment and apply tags dynamically.
This satisfies the third requirement, as Azure resource tags are not inherited automatically.

Key Concept

Azure governance tools boundary and capabilities (Azure Advisor, Azure Policy, Resource Locks)
Rate this question

Topics

Azure Advisor

More questions from this topic