Question 330 A team wants a managed service that remains available through one supported zone outage. What must it look for in the service configuration? Only that the resource name contains three numbers Only a management group with a resilient tag Only that the service is billed monthly A supported zone-redundant deployment or architecture Explanation Correct Answer D:Redundancy must be provided by the product's specific zone capability. Incorrect Answers A:Naming cannot create physical zone separation. B:Governance labels don't deploy redundant instances. C:Billing cadence doesn't prove zone resilience.
Question 331 A customer runs resources in three zones of one region and asks whether that guarantees survival of a region-wide outage. What is accurate? No; geographic disaster recovery needs an appropriate second-region design No; availability zones cannot improve any failure resilience Yes; three zones are always three separate geopolitical regions Yes; resource tags enable global failover automatically Explanation Correct Answer A:All zones can still share the loss of their parent region. Incorrect Answers B:Zones can mitigate individual zone failures. C:Zones are within a region. D:Tags are metadata only.
Question 332 An administrator plans to remove a resource group but finds a delete lock protecting a member resource. Which control should be reviewed? Storage access tier alone An availability zone number A billing estimate Azure resource locks and their inherited effects Explanation Correct Answer D:Deletion protection may block operations on the group or its members. Incorrect Answers A:Hot/cool selection does not govern ARM delete locks. B:Zone placement is distinct from resource management locks. C:Cost estimates do not prevent deletion.
Question 333 An automation team wants one deployment definition to create a network, storage and compute resources under a common management boundary. What is a typical target scope? A physical datacenter rack number An Azure resource group deployment Only an end-user browser tab Use an existing VM's name as the parent scope for an ARM resource-group deployment Explanation Correct Answer B:A group can serve as an ARM template deployment boundary for related resources. Incorrect Answers A:Infrastructure templates are not deployed to customer-owned racks in Azure. C:A browser tab isn't a durable Azure management scope. D:Resource groups, subscriptions and management groups are ARM scopes; an individual VM name is not the group parent.
Question 334 A firm uses one subscription for production and another for experimentation. Why might the separation be useful? Subscription separation automatically creates active-active regional failover Different RBAC, policy and cost boundaries can be applied to each subscription A subscription physically isolates every resource on dedicated hardware Every subscription is an independent Microsoft Entra tenant by definition Explanation Correct Answer B:Subscriptions support administrative separation while still belonging to an organizational hierarchy. Incorrect Answers A:Billing scopes are not deployment topology. C:Subscription boundaries do not guarantee dedicated hosts. D:Multiple subscriptions can share a directory tenant.
Question 335 An engineer assumes an Azure subscription can contain resources in only one region. What correction is appropriate? One resource group means one subscription per VM A subscription is identical to an Azure datacenter A subscription can contain eligible resources deployed in multiple regions Changing the subscription name relocates all resources Explanation Correct Answer C:The subscription is a billing and management scope, not a single region container. Incorrect Answers A:A subscription can contain many groups and VMs. B:Datacenters are physical facilities. D:Names do not move deployed resources.
Question 336 Who benefits most directly from a policy assignment at an Azure management group? Only a single local laptop's filesystem An unrelated internet certificate authority Only one VM's guest OS package manager Administrators needing consistent governance across many subscriptions Explanation Correct Answer D:The assignment can cover descendants instead of duplicating settings per subscription. Incorrect Answers A:Local files are not subscription governance scopes. B:Certificate issuance is distinct from Azure management hierarchy. C:Management group policy is an ARM control-plane concern.
Question 337 An organization assigns an Azure Policy restricting deployment regions at a management-group scope. Which resource behavior is expected? Every resource moves to a permitted region automatically regardless of policy effect Applicable deployments in descendant subscriptions are evaluated against the location rule Only VMs directly attached to the management group are evaluated A policy assignment changes the cloud region's physical location Explanation Correct Answer B:Policy inheritance can enforce an organization-wide allowed-region baseline. Incorrect Answers A:Deny and audit policies do not generally relocate workloads. C:Management groups contain subscriptions, not direct individual VM membership. D:Governance controls do not move datacenters.
Question 338 A security analyst should inspect one storage account but not all resources in its group. Which RBAC scope is most narrowly aligned? The individual storage account resource Every subscription in the tenant The physical Azure region The root management group Explanation Correct Answer A:Azure RBAC supports resource-level role assignments when appropriate. Incorrect Answers B:Organization-wide access exceeds the requirement. C:An Azure region is not the standard RBAC parent of the account. D:That would cover a much wider hierarchy.
Question 339 A team wants to move selected resources to a group under another subscription. What must it establish first? Whether each resource type and dependency supports that cross-subscription move That the two groups use identical tags That all resources always move across tenants without restrictions That both subscriptions have identical display colors Explanation Correct Answer A:Move operations have eligibility constraints beyond choosing destination names. Incorrect Answers B:Tag equality does not guarantee move support. C:Tenant and resource type limitations can apply. D:UI theme has no resource move impact.
Question 340 A new employee thinks Azure management groups store the organization's user passwords. What correction is relevant? Availability zones assign all users global administration Management groups replace the need for users and roles Azure regions store employee passwords by default Management groups organize subscription governance; Microsoft Entra ID manages cloud identities Explanation Correct Answer D:Governance hierarchy and identity directory have different roles. Incorrect Answers A:Zones do not manage identity privileges. B:Administrative scopes still require authorized identities. C:Regions are geographic infrastructure scopes.
