Question 320 Finance asks if a management group is itself a running Azure compute workload. What is correct? It is an organizational governance scope rather than deployed compute It is always a dedicated VM chargeable by hour It is a storage account access tier It is a replacement for virtual networks Explanation Correct Answer A:Management groups group subscriptions for access and policies. Incorrect Answers B:No VM is implied by a management group. C:Storage tiers concern object data placement and pricing. D:Management groups do not provide network connectivity.
Question 321 Which order correctly describes Azure governance scope from broad to narrow for a typical resource? Resource, management group, region, subscription Management group, subscription, resource group, resource Tenant user, disk partition, datacenter, role assignment Availability zone, subnet, resource group, management group Explanation Correct Answer B:This hierarchy supports delegated governance and access at appropriate scopes. Incorrect Answers A:Resources are not the parent of management groups. C:These concepts are not the ARM scope hierarchy. D:Physical and network concepts do not match the governance tree.
Question 322 A resource is in a group inside a subscription beneath a management group. Which statement describes inherited governance? Each resource is completely isolated from parent policies Higher-scope assignments can affect descendants, subject to supported rules and exemptions Only a VM's guest OS password determines Azure Policy inheritance Resource group names prevent policy inheritance by default Explanation Correct Answer B:The hierarchy permits central policies at broader scopes. Incorrect Answers A:Assignments can apply to descendant scopes. C:Guest credentials are separate from ARM policy evaluation. D:Naming does not negate parent scopes.
Question 323 A team wants different subscriptions for business units but one enterprise policy baseline. Where can that baseline be assigned most centrally? Individually on every VM's local filesystem only Only on one resource group in one subscription Assign policies to unrelated VMs individually instead of using subscription and management-group hierarchy At the appropriate common management group Explanation Correct Answer D:Parent assignments can apply to multiple child subscriptions. Incorrect Answers A:Local guest files cannot enforce subscription-wide Azure Policy. B:That scope does not cover the other subscriptions. C:Per-VM settings cannot establish the desired inherited governance across many subscriptions.
Question 324 A broad policy exists at a management group, but a test workload needs an approved exception. What should governance teams use? Rename the VM to ignore policy Delete every management group and subscription Change the application code language to evade all resource rules A supported policy exemption or carefully scoped adjustment according to governance rules Explanation Correct Answer D:Policy assignments and exemptions can document controlled deviations. Incorrect Answers A:Names don't bypass property-based policies except where a policy explicitly tests names. B:Removing the hierarchy would disrupt administration. C:Programming language does not supersede policy scope.
Question 325 An organization wants its workloads in two regions but one common ownership and cost attribution convention. Which concepts should be combined? Use only the subscription display name to provide regional failover Assume all tags automatically replicate data between regions Regional resource placement with consistent resource grouping and tags Treat a resource group as a physical duplicate region Explanation Correct Answer C:Deployment location and management metadata address different concerns. Incorrect Answers A:Billing scope does not implement runtime continuity. B:Tags don't move or copy application data. D:Logical groups don't create region redundancy.
Question 326 An architect sees an Azure resource group's location set to one region and a member storage account in another. Which conclusion is valid? The group must first be converted into a management group The resource group is physically located inside the storage account Resource group metadata and individual resource regions are separate properties The storage account is automatically invalid because the group is elsewhere Explanation Correct Answer C:A resource group can manage resources placed in multiple supported regions. Incorrect Answers A:Management groups are different hierarchy levels. B:Resource groups are management constructs. D:Group metadata does not force universal co-location.
Question 327 A business deploys in a primary Azure region and wants to activate a standby workload in a separate region after disaster. What must exist? Only an availability set of VMs in the same region Only a naming convention containing the words backup region An explicitly designed and tested secondary-region recovery arrangement Only a resource group in the primary region Explanation Correct Answer C:A deployment needs compatible resources, data strategy and activation procedure. Incorrect Answers A:Availability sets do not create geographic failover. B:Names don't provision failover capacity. D:Logical grouping cannot host an independent regional recovery workload.
Question 328 A team wants to rely on Azure platform geo-replication for a particular service. What should it verify? Move the resource into a management group named DisasterRecovery The service's supported redundancy option and actual replication geography Set a resource tag named geo to true Assume every Azure service uses its region pair identically Explanation Correct Answer B:Pairing relationships do not automatically determine every product's replication behavior. Incorrect Answers A:Hierarchy labels do not replicate data. C:Tags cannot enable unavailable replication. D:Replication features differ by service.
Question 329 An application spans availability zones in one region and transfers data synchronously between components. What should its designers consider? The application's region name is the only latency factor Inter-zone network latency and data transfer implications where applicable Zone distribution eliminates every network communication cost Zones are always within the same physical rack Explanation Correct Answer B:Zone distribution improves fault isolation but can affect communication costs and latency. Incorrect Answers A:Actual component placements and network paths matter. C:Cross-zone traffic pricing can depend on service and usage. D:Zones are physically separated locations.
Question 330 A team wants a managed service that remains available through one supported zone outage. What must it look for in the service configuration? Only that the resource name contains three numbers Only a management group with a resilient tag Only that the service is billed monthly A supported zone-redundant deployment or architecture Explanation Correct Answer D:Redundancy must be provided by the product's specific zone capability. Incorrect Answers A:Naming cannot create physical zone separation. B:Governance labels don't deploy redundant instances. C:Billing cadence doesn't prove zone resilience.
