Task 1.3: Manage Azure subscriptions and governance

• ARequire a tag on resources

  Incorrect

  This deny policy blocks resources without the tag instead of adding the value, so deployments without it would fail.

• BInherit a tag from the resource group if missing

  Correct

  This modify policy adds the resource group's tag value to a resource only when the resource doesn't already have that tag.

• CInherit a tag from the resource group

  Incorrect

  This variant applies the resource group's value even when the resource already has the tag, overwriting values set on purpose.

• DAdd a tag to resources

  Incorrect

  This policy adds a fixed name and value you supply in the assignment, not the value each resource group carries.

The "if missing" inherit policy copies the parent's value only onto resources without the tag; the plain inherit policy replaces existing values too.

• AThe lock is CanNotDelete, which blocks power operations

  Incorrect

  A CanNotDelete lock lets authorized users read and modify a resource; it blocks only deletion.

• BVirtual Machine Contributor lacks the restart action

  Incorrect

  The role includes VM power operations; the operators could restart the VMs before the lock was added.

• CThe operators also need Reader on the resource group

  Incorrect

  Virtual Machine Contributor already includes read access to the VMs, so adding Reader changes nothing for start or restart.

• DThe lock is ReadOnly, which blocks POST calls such as restart

  Correct

  A ReadOnly lock blocks the POST requests that start and restart VMs, so even authorized users can't run them.

Locks act on the control plane. A ReadOnly lock acts like limiting users to Reader and blocks POST operations, so starting or restarting a VM in a locked resource group fails; a CanNotDelete lock only prevents deletion.

• AResources don't inherit the tags of their resource group

  Correct

  A tag on a resource group isn't applied to the resources in it; you need a tag policy to copy it, or tag inheritance in Cost Management to apply it to their usage records.

• BCost analysis reads tags from subscriptions, not resource groups

  Incorrect

  Cost analysis groups by the tags on each resource's costs; these resources simply carry no Department tag.

• CTag values are case-sensitive in cost analysis filters

  Incorrect

  Values are case-sensitive, but a casing mismatch wouldn't leave every resource without a tag.

• DA ReadOnly lock on RG-Sales keeps tags from reaching its resources

  Incorrect

  No lock is involved here, and a lock doesn't decide whether a resource group's tags reach the resources inside it; they never do on their own.

Tags applied to a resource group or subscription aren't inherited by the resources inside it. To get the tag onto resources, assign a tag policy such as one of the inherit definitions, or tag the resources directly. For cost reporting alone, the tag inheritance setting in Cost Management applies resource group tags to the child resources' usage records.

• AMove the disks and NIC into RG-Compute, then move them with VM1

  Correct

  Across subscriptions, a resource and its dependent resources must sit in the same resource group and move together.

• BRegister the Microsoft.Compute provider in the source subscription

  Incorrect

  Registration matters in the destination subscription, and the source already runs the VM, so it's registered there.

• CChange the target subscription's tenant to match the source

  Incorrect

  Both subscriptions are already in the same tenant, which is a requirement the move meets.

• DUse Azure Resource Mover to move VM1 and its disks

  Incorrect

  Switching tools doesn't fix the failed validation; for a subscription move the dependent resources must first sit in one resource group.

Moving to another subscription is a three-step process: gather dependent resources into one resource group, move them together, then redistribute them if you like. The subscriptions must share a tenant and the destination must be registered for the resource provider.

• ASet the budget's threshold to 100 percent; the budget stops the VMs

  Incorrect

  Budget thresholds send notifications only; resources aren't affected and consumption isn't stopped.

• BA spending limit on the subscription

  Incorrect

  A spending limit exists only on subscriptions with credits, such as free trials, and disables the whole subscription rather than stopping VMs.

• CAn action group on the budget alert that runs an automation runbook

  Correct

  A budget at subscription scope can call an action group, which can run a runbook or Logic App that stops the VMs.

• DAn Azure Policy assignment with the deny effect

  Incorrect

  Deny blocks noncompliant create or update requests; it can't react to cost or stop running VMs.

Budgets evaluate cost and notify, but don't affect resources. For a subscription or resource group budget you can attach an action group, and the action group can start automation such as a runbook that shuts VMs down.

• AOwner role on the subscription

  Correct

  Moving a subscription needs the Owner role (or equivalent write rights) on the child subscription.

• BOwner role on the Tenant Root Group

  Incorrect

  When the current parent is the root management group, you don't need permissions on it to move the subscription away.

• CAccount owner of the subscription's billing account

  Incorrect

  Billing ownership controls invoices and payment, not where the subscription sits in the management group hierarchy.

• DManagement Group Contributor on MG-Corp

  Correct

  You need write access on the target parent management group, which Management Group Contributor provides.

• EGlobal Administrator role in Microsoft Entra ID

  Incorrect

  The move checks Azure permissions on the subscription and the management groups, which this directory role isn't.

To move a subscription you need write rights on the subscription (Owner) and on the target parent management group, and on the current parent unless it's the root management group, which is the exception here.

• AA management group for each policy

  Incorrect

  Management groups organize subscriptions; they don't bundle policies.

• BAn initiative definition that contains the eight policies

  Correct

  An initiative groups policy definitions so they're assigned and reported together.

• CA resource lock with the eight policies attached

  Incorrect

  Locks don't contain policies; they prevent deletion or changes.

• DEight separate policy assignments per subscription

  Incorrect

  Separate assignments work but have to be managed and tracked one by one.

An initiative (policy set) groups several policy definitions toward one goal, with a single assignment and an aggregated compliance view.

• AA cost anomaly alert on the subscription

  Incorrect

  Anomaly alerts flag unusual changes, not projected budget overruns.

• BAzure Advisor cost recommendations for the subscription

  Incorrect

  Advisor suggests savings such as resizing; it doesn't compare spending with a budget.

• CA forecasted cost alert at 100 percent

  Correct

  Forecasted alerts fire when the projected cost is expected to exceed the threshold, giving early warning.

• DAn actual cost alert at 100 percent

  Incorrect

  An actual cost alert fires once the money is already spent.

Budgets support alerts on actual cost and on forecasted cost. Forecasted alerts use cost predictions to warn that the threshold is likely to be crossed.

• ATag Contributor

  Correct

  Tag Contributor grants write access to tags without access to the resources themselves.

• BReader

  Incorrect

  Reader can see tags but can't change them.

• CContributor

  Incorrect

  Contributor can change and delete the resources, which isn't wanted.

• DResource Policy Contributor

  Incorrect

  This role manages policy definitions and assignments, not tags on resources.

Writing to Microsoft.Resources/tags lets a user tag a resource without other access to it, and the Tag Contributor role grants exactly that. It can't tag resources through the portal, but it supports every tag operation through PowerShell and the REST API.

• ABoth the names and the values are case-sensitive

  Incorrect

  Names aren't case-sensitive for operations, so env and Env are the same tag.

• BBoth the names and the values are case-insensitive

  Incorrect

  Values are compared with case, so Prod and prod are different values.

• CThe names match regardless of case, but the values differ

  Correct

  Tag names are case-insensitive for operations, while tag values are case-sensitive.

• DThe names differ by case, but the values match

  Incorrect

  It's the other way round: names match and values differ.

Tag names are case-insensitive for operations, though the provider may keep the casing you typed, and tag values are case-sensitive.