Examkin

Question

Difficulty: Very hardSecurity, Governance, and Manageability

A financial services company is planning the governance, security, and resource management structure for a new application. The deployment consists of database servers hosted on Azure Virtual Machines (IaaS) and a web frontend hosted on Azure App Service (PaaS).

The IT department proposes the following configuration:
1. Group all application resources into a single Resource Group located in the East US region, even though some data compliance laws require the database virtual machines to reside in West Europe.
2. Delegate all operating system patching and middleware configuration tasks to Microsoft for both the database Virtual Machines and the App Service instances.
3. Nest separate sub-resource groups inside the main Resource Group to isolate production and non-production environments.

Which of the following statements correctly evaluates the feasibility and compliance of this proposed configuration?

  1. Deploying West Europe resources in the East US resource group is allowed, nesting resource groups is not supported, and operating system patching is the customer's responsibility only for the Virtual Machines.Answer
  2. B
    Deploying West Europe resources in the East US resource group is blocked because resources must inherit their resource group's location, and operating system patching is the customer's responsibility for both services.
  3. C
    Deploying West Europe resources in the East US resource group is allowed, nesting resource groups is supported for environment isolation, and operating system patching is Microsoft's responsibility for both services.
  4. D
    Deploying West Europe resources in the East US resource group is blocked because resources must inherit their resource group's location, nesting resource groups is not supported, and operating system patching is Microsoft's responsibility for both services.

Answer

Deploying West Europe resources in the East US resource group is allowed, nesting resource groups is not supported, and operating system patching is the customer's responsibility only for the Virtual Machines.
The correct option correctly identifies that resources do not need to match their resource group's location, resource groups cannot be nested, and OS patching is a customer responsibility for IaaS (Virtual Machines) but managed by Microsoft for PaaS (App Service).

Step-by-Step Solution

1
Evaluate the Resource Group location requirement.
Resource groups only store deployment metadata and do not restrict the geographical regions of the resources inside them.
This determines if West Europe database virtual machines can reside in an East US resource group.
2
Evaluate Resource Group structure constraints.
Azure resource groups are a flat structure; nesting resource groups inside other resource groups is not supported.
This determines if proposal 3 is feasible.
3
Apply the Shared Responsibility Model to OS patching.
For IaaS (Virtual Machines), the customer manages and patches the OS. For PaaS (App Service), the cloud provider (Microsoft) handles OS patching and maintenance.
This determines who is responsible for OS updates in proposal 2.

Key Concept

Azure resource group limitations and the division of operational duties between IaaS and PaaS under the shared responsibility model.
Rate this question

Topics

Security, Governance, and Manageability

More questions from this topic