Examkin

Tüm alıştırma soruları

291 soru

Tüm türler1,186Çoktan seçmeli620Çoklu seçim228Doğru / Yanlış291Eşleştirme47
Soru 1Soru →

An administrator is configuring resource tags in an Azure subscription to manage and track department expenditures. Is the statement that resource tags can be used to split a single Azure subscription's billing into multiple separate invoices true or false?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false because resource tags cannot be used to split a single Azure subscription's billing into multiple separate invoices.
The correct answer is false because resource tags do not have the capability to alter the billing structure or split a subscription's bill into separate invoices. Invoices are generated at the subscription or billing profile level.

Adım Adım Çözüm

1
Examine the role of Azure resource tags in cost management.
Resource tags are key-value pairs applied to resources to help organize and report cost data within tools like Azure Cost Analysis.
Understanding the functional capabilities of resource tags helps determine if they can modify billing documents.
2
Determine the billing and invoice boundary in Azure.
Invoices are generated based on subscription boundaries and billing profiles, not resource-level tags.
Comparing the tag functionality against billing capabilities clarifies whether tags can split invoices.

Anahtar Kavram

Resource tags are metadata used for categorization and reporting but do not alter billing boundaries or invoice generation.
Soru 2Soru →

When an organization hosts an application on Azure under a consumption-based model, a temporary surge in user traffic that triggers automated resource scaling will result in a corresponding increase in the organization's Operational Expenditure (OpEx) for that billing period.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

The statement is true because a consumption-based model charges based on actual resource utilization, which scales up during traffic surges, and these ongoing cloud service costs are classified as Operational Expenditure (OpEx).
The statement is correct because consumption-based pricing is variable and based on actual utilization. When a traffic spike causes resources to scale out, more capacity is consumed, which directly increases the bill. Since these are ongoing operational costs without upfront physical asset purchases, they are classified as Operational Expenditure (OpEx).

Adım Adım Çözüm

1
Analyze how resource utilization behaves under a consumption-based model when traffic changes.
In a consumption-based model, resources scale dynamically to meet demand, meaning resource consumption rises during a traffic surge.
To establish the relationship between application traffic and resource consumption.
2
Evaluate the direct impact of increased resource scaling on billing.
Because billing is directly tied to the level of consumption, an increase in resource usage leads to a higher cloud bill for that period.
To determine how changes in consumption affect financial cost.
3
Classify the expense type of ongoing, usage-based cloud billing.
Ongoing cloud resource billing with no upfront infrastructure cost is classified under accounting standards as Operational Expenditure (OpEx).
To verify that the resulting cost increase is correctly categorized as OpEx.

Anahtar Kavram

Cloud resource usage under a consumption-based model dynamically scales billing based on demand and is categorized as Operational Expenditure (OpEx).
Soru 3Soru →

An organization is planning to migrate a relational database to Azure. To minimize administrative overhead, the database solution must support automatic operating system patching, database software updates, and automated backups. Additionally, the database administrators require full administrative control over the underlying operating system to install custom third-party monitoring agents. The organization's cloud architect recommends deploying Azure SQL Database. Is this recommendation correct?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The recommendation is incorrect because Azure SQL Database, as a Platform as a Service (PaaS) offering, does not provide administrative access to the underlying operating system.
The recommendation is incorrect because Azure SQL Database is a fully managed Platform as a Service (PaaS) offering. While it satisfies the need for automatic patching, updates, and backups, it does not provide users with administrative access or control over the underlying operating system. To install custom monitoring agents directly on the OS, the organization would have to deploy their database on an Azure Virtual Machine (IaaS), which would then require them to manually manage OS and database updates.

Adım Adım Çözüm

1
Analyze the requirements for the migrated database.
The database needs automatic patching, updates, and backups (typically provided by PaaS), but also requires full OS administrative control to install custom agents (typically requiring IaaS).
To evaluate if the proposed solution meets all requirements.
2
Evaluate the capabilities of the recommended service, Azure SQL Database.
Azure SQL Database is a PaaS relational database service. It automates patching, updates, and backups, but does not allow administrative access to the underlying operating system.
To compare the service capabilities with the required features.
3
Determine whether the recommendation satisfies the OS-level access requirement.
The requirement for OS administrative control cannot be met by Azure SQL Database, making the recommendation incorrect.
To form the final true/false evaluation.

Anahtar Kavram

Understanding the management responsibilities and administrative boundaries of Azure PaaS relational database services versus IaaS database deployments.
Soru 4Soru →

A retail company has several physical stores, each running Windows and Linux servers on-premises. The company wants to manage and monitor these on-premises servers alongside their Azure resources using a single control plane.

Statement: The company can use Azure Arc to project these on-premises physical servers into Azure Resource Manager as hybrid machines.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True
Azure Arc allows organizations to project physical and virtual servers running on-premises or in other clouds into Azure Resource Manager, representing them as hybrid machines that can be managed from the Azure portal.

Adım Adım Çözüm

1
Identify the organization's goal to extend Azure's centralized management to physical servers located outside of Azure's cloud infrastructure.
The organization needs a way to bridge non-Azure on-premises servers with Azure Resource Manager.
This establishes the hybrid environment context for the question.
2
Determine if Azure Arc is the service designed to extend Azure Resource Manager to external resources.
Azure Arc functions specifically to project external resources, including on-premises Windows and Linux servers, into Azure Resource Manager as hybrid machines.
This verifies the validity of the statement.

Anahtar Kavram

Azure Arc extends the Azure control plane (Azure Resource Manager) to secure and govern infrastructure and applications outside of Azure, including on-premises and multi-cloud servers.
Soru 5Soru →

An administrator assigns a user the Reader role at the scope of an Azure subscription. Determine if the following statement is true or false: The user will automatically have read access to all resources within that subscription due to role inheritance.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True
Assigning a role at the subscription level automatically propagates those permissions to all child resource groups and resources due to the hierarchical inheritance model of Azure RBAC.

Adım Adım Çözüm

1
Identify the scope at which the role assignment is made.
The Reader role is assigned at the subscription scope, which sits above resource groups and individual resources in the Azure resource hierarchy.
Understanding where the permission is applied is key to determining how it propagates.
2
Apply the Azure RBAC inheritance rules.
Permissions assigned at a parent scope (like a subscription) are inherited by all child scopes (like resource groups and resources).
This is a fundamental mechanism of Azure's governance structure.
3
Evaluate the user's access to the resources within the subscription.
Because of inheritance, the user automatically receives Reader access to all resources in all resource groups under that subscription.
Determines the truth value of the target statement.

Anahtar Kavram

Azure RBAC scope inheritance
Tahmini Süre:45s
Soru 6Soru →

Azure SQL Database is a Platform as a Service (PaaS) offering that automatically handles database management tasks such as software patching and backups without user intervention.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

Azure SQL Database is a Platform as a Service (PaaS) offering that automatically handles database management tasks.
Azure SQL Database is a Platform as a Service (PaaS) database where Microsoft automatically manages the underlying database engine, including patching and backups.

Adım Adım Çözüm

1
Identify the service category of Azure SQL Database.
Azure SQL Database is classified as a Platform as a Service (PaaS) offering.
Microsoft manages the underlying infrastructure, operating system, and database software.
2
Determine the management responsibilities of a PaaS database offering.
In a PaaS model, management tasks such as backups, patching, and upgrading are automatically handled by the cloud provider.
The shared responsibility model dictates that database engine management and patching are shifted to Microsoft in a PaaS database solution.

Anahtar Kavram

Azure SQL Database management responsibilities
Soru 7Soru →

A company is planning a hybrid network architecture to connect their on-premises datacenter to Azure services. Due to strict compliance requirements, all data transferred must be encrypted in transit. The network administrator proposes using a standard Azure ExpressRoute circuit to meet both the high-bandwidth demand and the encryption requirement. True or false: The proposed solution meets the encryption requirement by default.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
The proposed solution does not meet the encryption requirement by default. Although Azure ExpressRoute provides a private, high-speed, and low-latency connection that bypasses the public internet, it does not encrypt data in transit by default. To achieve encryption over ExpressRoute, additional configurations like a site-to-site VPN over the circuit or MACsec (for ExpressRoute Direct) must be implemented.

Adım Adım Çözüm

1
Analyze the requirements in the scenario.
The requirements are high-bandwidth connectivity and guaranteed encryption in transit for data moving between on-premises and Azure.
Understanding the customer's constraints is the first step in determining the correctness of the proposal.
2
Evaluate the capabilities of a standard Azure ExpressRoute circuit.
ExpressRoute provides high bandwidth, low latency, and a private connection that bypasses the public internet, but it does not encrypt traffic by default.
We must verify if the proposed technology natively satisfies the encryption requirement without additional setup.
3
Determine if the proposed solution meets the encryption requirement by default.
Since standard ExpressRoute does not encrypt traffic in transit by default, the proposed solution does not meet the compliance requirement on its own.
This leads to the final determination that the statement is false.

Anahtar Kavram

Azure ExpressRoute provides private, high-bandwidth connectivity to Azure but does not encrypt traffic by default.
Soru 8Soru →

When deploying containers using Azure Container Instances, you must manually configure and patch the virtual machines that host the workloads.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
The statement is false because Azure Container Instances is a serverless container hosting platform. Under the Platform as a Service (PaaS) model, the cloud provider manages and patches the host operating system and virtual machines, allowing users to run containers directly without infrastructure management.

Adım Adım Çözüm

1
Analyze the service model of Azure Container Instances.
Azure Container Instances functions as a serverless container hosting service.
Determining the service model helps identify who is responsible for managing the underlying host infrastructure under the shared responsibility model.
2
Evaluate the infrastructure management responsibilities for the service.
Azure handles all host operating system patching, hardware provisioning, and virtualization layers automatically.
This eliminates the requirement for the customer to manually configure or patch the underlying virtual machines.

Anahtar Kavram

Azure Container Instances provides serverless container execution, removing the administrative overhead of managing, configuring, or patching host virtual machines.
Soru 9Soru →

A team is establishing a connection between their physical office and an Azure Virtual Network. They require a connection that does not traverse the public internet. Is the following statement true? A VPN Gateway connection is the correct choice to meet this requirement.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
The correct answer is False because a VPN Gateway establishes an encrypted tunnel over the public internet. The requirement specifically demands a connection that does not traverse the public internet, which can only be satisfied by using ExpressRoute.

Adım Adım Çözüm

1
Analyze the connectivity requirements specified in the scenario.
The scenario requires a connection between a physical office and Azure that does not travel over the public internet.
This helps identify which network services are eligible.
2
Evaluate how VPN Gateway routes network traffic.
A VPN Gateway creates an encrypted tunnel, but this tunnel runs over the public internet.
To determine if the statement is true or false.
3
Compare with ExpressRoute capabilities.
ExpressRoute provides a private, dedicated connection that bypasses the public internet entirely.
To confirm that ExpressRoute, not VPN Gateway, is the correct service.

Anahtar Kavram

Azure VPN Gateway routes traffic over the public internet, whereas ExpressRoute bypasses it.
Soru 10Soru →

Determine if the following statement is true or false: An Azure ExpressRoute connection routes network traffic between an on-premises network and Azure resources over the public internet using built-in IPsec encryption.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
The statement is false. Azure ExpressRoute provides a private connection to Microsoft services via dedicated circuits. Therefore, traffic does not traverse the public internet, and it is not encrypted by default.

Adım Adım Çözüm

1
Analyze the transmission medium described in the statement.
ExpressRoute utilizes private, dedicated WAN links provided by a partner connectivity provider.
This establishes that ExpressRoute traffic does not travel over the public internet.
2
Analyze the default encryption state of ExpressRoute.
ExpressRoute does not encrypt traffic by default.
While customers can configure encryption over ExpressRoute, it is not built-in or enabled by default.

Anahtar Kavram

ExpressRoute provides a private, dedicated, and unencrypted-by-default connection that bypasses the public internet.
Soru 11Soru →

An organization needs to deploy a containerized application that requires secure access to on-premises resources over a private connection. Is the statement true or false that Azure Container Instances (ACI) supports deployment directly into a delegated subnet of an Azure Virtual Network (VNet) to enable this secure connection?

Cevabı ve açıklamayı göster

Cevap: True

Cevap

The statement is true because Azure Container Instances supports virtual network integration via delegated subnets.
The statement is correct because Azure Container Instances supports virtual network integration using subnet delegation, allowing private communication with on-premises resources.

Adım Adım Çözüm

1
Identify the networking requirements of the scenario.
The scenario requires a containerized application to securely access on-premises resources over a private connection (typically via an Azure Virtual Network and a VPN or ExpressRoute connection).
Understanding the networking requirements helps determine if the selected service supports virtual network integration.
2
Evaluate the capabilities of Azure Container Instances regarding virtual network deployment.
Azure Container Instances supports deploying container groups into a delegated subnet of an Azure Virtual Network.
Delegated subnet integration enables containers in the container group to communicate privately with on-premises networks and other virtual network resources.

Anahtar Kavram

Azure Container Instances Virtual Network Integration
Soru 12Soru →

Azure Role-Based Access Control (RBAC) is used to enforce resource compliance rules, such as restricting the deployment of virtual machines to specific allowed sizes.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false because Azure RBAC manages user access permissions, whereas restricting resource configurations like virtual machine sizes is managed by Azure Policy.
The statement is false. Azure RBAC is used to manage user authorization and control access to Azure resources (who can access what). Enforcing resource compliance rules, such as restricting virtual machine sizes or allowed locations, is managed by Azure Policy.

Adım Adım Çözüm

1
Analyze the action described in the statement: restricting virtual machine deployments to specific sizes.
This is a configuration compliance rule.
To determine which Azure service handles this constraint.
2
Recall the purpose of Azure RBAC.
Azure RBAC authorizes user actions (e.g., who can create a virtual machine). It does not inspect or restrict the properties of the resource being created (e.g., size or region).
To verify if RBAC can enforce the specified rule.
3
Recall the purpose of Azure Policy.
Azure Policy evaluates and enforces compliance rules on resource properties, such as allowed SKU sizes or deployment regions.
To identify the correct tool for the described scenario.

Anahtar Kavram

Difference between Azure Role-Based Access Control (RBAC) and Azure Policy
Tahmini Süre:45s
Soru 13Soru →

A company is planning to deploy a complex microservices application to Azure. The application architecture requires advanced orchestration capabilities, including automated horizontal pod autoscaling, rolling updates, and built-in service discovery across dozens of container groups. A cloud consultant suggests that using Azure Container Instances (ACI) is the best solution because it natively provides all of these advanced container orchestration and cluster management capabilities without requiring any additional services. Is this statement regarding the native capabilities of Azure Container Instances (ACI) true or false?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false.
The correct answer is false. Azure Container Instances (ACI) is designed for quick, isolated container hosting and does not support native orchestration features such as horizontal pod autoscaling, automated rolling updates, or service discovery across multiple groups. A service like Azure Kubernetes Service (AKS) is required to fulfill those requirements.

Adım Adım Çözüm

1
Analyze the application requirements.
The application requires advanced orchestration capabilities: automated horizontal pod autoscaling, rolling updates, and built-in service discovery.
These requirements indicate a need for a container orchestrator rather than just a container hosting environment.
2
Evaluate the capabilities of Azure Container Instances (ACI).
ACI is a Platform-as-a-Service (PaaS) offering that allows you to run containers on-demand without managing virtual machines. It lacks native orchestration features like rolling updates, built-in service discovery, or automatic horizontal pod scaling.
This determines whether ACI satisfies the architectural constraints natively.
3
Compare ACI with Azure Kubernetes Service (AKS).
AKS is a fully managed Kubernetes service that provides cluster management, rolling upgrades, horizontal pod autoscaling, and service discovery natively.
Understanding the division of features between ACI and AKS helps verify which service fits the scenario.

Anahtar Kavram

Distinction between Azure Container Instances (ACI) basic hosting and Azure Kubernetes Service (AKS) container orchestration capabilities.
Soru 14Soru →

A retail company is migrating its inventory management system to Azure. The database must track relationships between products, suppliers, and orders, enforcing referential integrity through foreign keys and supporting complex multi-table joins. The systems architect proposes deploying Azure Cosmos DB to host this relational workload. Is the systems architect's proposal correct?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The correct answer is False.
The correct answer is False because the requirements describe a relational database workload (foreign keys, referential integrity, and complex joins), whereas Azure Cosmos DB is a non-relational (NoSQL) database service.

Adım Adım Çözüm

1
Analyze the workload requirements: tracking relationships (products, suppliers, orders), referential integrity (foreign keys), and complex joins.
Identify that the system requires a relational database management system.
Foreign keys and complex joins are standard features of relational databases.
2
Evaluate the proposed Azure service: Azure Cosmos DB.
Identify that Azure Cosmos DB is a non-relational (NoSQL) database service.
Cosmos DB is built for non-relational, schema-free data models.
3
Assess the fit of Azure Cosmos DB for the relational workload.
Conclude that Cosmos DB is not suitable for a workload that relies on native relational constraints and multi-table joins, making the proposal incorrect.
Azure Cosmos DB is not a relational database, so the proposal is False.

Anahtar Kavram

Azure Cosmos DB is a non-relational (NoSQL) database service, which is not designed to natively handle relational workloads requiring strict referential integrity (foreign keys) and complex multi-table joins.
Soru 15Soru →

When utilizing Azure Cosmos DB with the API for NoSQL, developers can query JSON documents using structured query language (SQL) syntax, and the database service automatically enforces relational integrity constraints, such as foreign keys, across multiple containers.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
The correct answer is False because Azure Cosmos DB is a non-relational database. The API for NoSQL allows querying JSON data using structured query language (SQL) syntax, but it does not support or enforce relational database constraints like foreign keys across different containers.

Adım Adım Çözüm

1
Analyze the database service and query API specified in the statement: Azure Cosmos DB using the API for NoSQL.
Identify that Azure Cosmos DB is a non-relational (NoSQL) database engine, and the API for NoSQL acts as a document query interface using SQL-like syntax.
Understanding the underlying architecture of the service is required to evaluate its capabilities.
2
Evaluate the statement's claim that the database service automatically enforces relational integrity constraints (like foreign keys) across containers.
Recognize that NoSQL document databases do not enforce relational schema constraints or foreign keys across collections/containers.
This tests whether the query syntax capabilities are being conflated with schema constraint enforcement.
3
Determine the correct truth value of the statement.
Since the service does not enforce relational constraints across containers, the statement is false.
To complete the evaluation and state the final answer.

Anahtar Kavram

Azure Cosmos DB is a non-relational database service that supports SQL querying but does not enforce relational database schema constraints like foreign keys.
Soru 16Soru →

An organization has configured an Azure ExpressRoute circuit as their primary hybrid connection and a Site-to-Site VPN as a backup to the same Azure Virtual Network. Is the statement true or false that Azure automatically routes traffic to the Site-to-Site VPN gateway if the ExpressRoute circuit fails, without requiring any custom User-Defined Routes (UDRs) to be configured?

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True
The statement is true because Azure natively supports coexistence of ExpressRoute and VPN gateways. BGP advertisements manage the routing hierarchy, automatically directing traffic to the VPN connection if the primary ExpressRoute path is lost, without any need for User-Defined Routes (UDRs).

Adım Adım Çözüm

1
Understand the coexistence setup of Azure ExpressRoute and Site-to-Site VPN on the same Virtual Network.
Both connections advertise on-premises network ranges to Azure, but ExpressRoute has a higher default routing weight/preference.
This establishes ExpressRoute as the primary path and VPN as the backup path.
2
Analyze what happens during an ExpressRoute link failure.
The ExpressRoute routes are withdrawn from the Azure routing table.
BGP dynamically updates the route table when the physical path becomes unavailable.
3
Evaluate the routing decision made by Azure after ExpressRoute route withdrawal.
Azure falls back to the Site-to-Site VPN route that is already propagated via BGP.
No manual route injection or User-Defined Routes (UDRs) are needed because BGP handles the path failover dynamically.

Anahtar Kavram

ExpressRoute and Site-to-Site VPN Gateway coexistence and automatic failover
Soru 17Soru →

A CanNotDelete resource lock is applied to an Azure resource group.

Authorized users can modify the configuration settings of the resources inside this resource group.

Is this statement true or false?

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True
A CanNotDelete resource lock restricts only the deletion of resources. Authorized users remain fully able to modify and update configuration settings on resources within the locked scope.

Adım Adım Çözüm

1
Identify the type of resource lock applied.
The applied lock is a CanNotDelete lock.
The stem specifies that a CanNotDelete resource lock is applied to the resource group.
2
Determine the rules and constraints of a CanNotDelete lock.
It prevents deletion of resources but permits read and modification operations.
By definition, a CanNotDelete lock only restricts the delete action, allowing authorized users to make changes to configurations.
3
Evaluate the statement based on the lock rules.
The statement is true.
Since the lock permits modifications, authorized users are allowed to modify resource configuration settings.

Anahtar Kavram

Azure Resource Locks prevent accidental deletion or modification. A CanNotDelete lock restricts only deletion, allowing authorized users to read and modify resources.
Soru 18Soru →

Determine if the following statement is true or false:

A developer who is assigned the Owner role for an Azure resource group can successfully create Azure SQL databases in that resource group, even if an Azure Policy is assigned at the parent subscription level to deny the creation of SQL databases.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false. Azure Policy restrictions are evaluated at resource deployment and take precedence over Azure Role-Based Access Control (RBAC) permissions, meaning even a user with the Owner role cannot create a resource that violates a Deny policy.
The statement is false. Azure Policy evaluates resource creation requests and applies restrictions independently of Azure RBAC permissions. An Owner role grants permissions under RBAC, but it does not grant the authorization to bypass active Azure Policy deny rules.

Adım Adım Çözüm

1
Determine the user's authorization level under Azure RBAC.
The user has the Owner role on the resource group, which grants full management rights to all resources inside that resource group, including creation rights.
To evaluate what actions the user is authorized to attempt.
2
Determine the policy scope and restriction.
An Azure Policy denying SQL database creation is applied at the subscription level, which is a parent scope that automatically inherits down to the resource group.
To identify active policy rules that apply to the resource group.
3
Compare the precedence of RBAC and Azure Policy rules.
During resource deployment, Azure Policy is evaluated first. If a Deny policy is violated, the deployment is blocked even if the user has the RBAC permissions to create the resource.
To resolve conflicts between RBAC access permissions and Azure Policy constraints.

Anahtar Kavram

Azure RBAC vs. Azure Policy precedence
Soru 19Soru →

An organization has an Azure subscription containing multiple resource groups. An administrator wants to ensure that no users can create virtual machines within the subscription. The administrator removes all Owner and Contributor role assignments at the subscription level.

Is the statement 'Removing these role assignments at the subscription level guarantees that no users can create virtual machines anywhere within the subscription' true or false?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false.
The correct answer is false because Azure RBAC permissions are additive. Removing subscription-level roles does not prevent users from having roles assigned directly at the resource group scope, which would allow them to create virtual machines in those specific resource groups. Furthermore, enforcing resource compliance subscription-wide is a capability of Azure Policy, not Azure RBAC.

Adım Adım Çözüm

1
Analyze the action taken by the administrator at the subscription scope.
All Owner and Contributor role assignments are removed at the subscription level, meaning no permissions are inherited from the subscription scope to child scopes for these roles.
To understand the baseline permissions inherited by resource groups.
2
Evaluate the possibility of RBAC role assignments at lower scopes.
Users can still be assigned roles like Contributor or Virtual Machine Contributor directly at the resource group scope.
Azure RBAC allows roles to be assigned at different levels (Management Group, Subscription, Resource Group, Resource), and permissions are additive.
3
Evaluate the role of Azure Policy vs. Azure RBAC for enforcing subscription-wide compliance rules.
Removing RBAC roles does not enforce a compliance rule; to guarantee that no virtual machines can be created subscription-wide, an Azure Policy with a Deny effect should be applied.
Azure Policy is designed for governing and enforcing resource creation standards, whereas RBAC is designed for managing identity-based permissions.

Anahtar Kavram

Azure RBAC inheritance and scope properties, and the distinction between Azure RBAC and Azure Policy.
Soru 20Soru →

To prevent a specific user from deleting virtual machines in an Azure resource group, you should assign an Azure Policy definition that denies the delete action on virtual machines.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
The correct answer is False because controlling what actions a specific user can perform, such as preventing them from deleting virtual machines, is managed through Azure Role-Based Access Control (RBAC) rather than Azure Policy. Azure Policy focuses on resource governance and properties at a scope, and does not target specific users.

Adım Adım Çözüm

1
Identify the goal of the governance requirement.
The goal is to restrict a specific user from performing a management action, which is deleting virtual machines.
Determining whether the goal is user authorization or resource compliance helps select the correct Azure service.
2
Evaluate the role of Azure Policy.
Azure Policy is used to enforce resource properties and compliance at a scope (e.g., ensuring resource tags exist or restricting VM sizes) and applies to all actions within that scope regardless of the user.
This rules out Azure Policy for user-specific permission control.
3
Evaluate the role of Azure Role-Based Access Control (RBAC).
Azure RBAC manages user authorization by defining who (users, groups, service principals) can perform what actions (read, write, delete) on Azure resources.
Since the requirement is to restrict a specific user's delete action, Azure RBAC (such as assigning the Reader role or a custom role lacking delete permissions) must be used.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) manages user authorization, whereas Azure Policy manages resource properties and compliance.
Sayfa 1 / 15Sonraki