Question 790 One resource complies with a resource-group policy but violates a management-group policy. What should governance review? Only a storage account key All applicable policy assignments inherited or directly scoped to the resource Only the resource group's newest display name Only the VM guest OS version Explanation Correct Answer B:Compliance is affected by more than the nearest assignment. Incorrect Answers A:Storage credentials aren't the hierarchy of policies. C:Naming doesn't reveal all inherited assignments. D:Guest OS may not explain an ARM location rule.
Question 791 An enterprise has a configuration requirement not covered by the built-in Azure Policy definitions. What capability can it use? An unmanaged public web app for policy storage Store the required rule only in a read-only human document A custom Azure Policy definition with correctly tested conditions and effects An Azure VPN Gateway connection Explanation Correct Answer C:Custom rules can target supported Azure Resource Manager properties. Incorrect Answers A:A website isn't the Policy evaluation engine. B:Documentation is not the structured custom Policy definition evaluated by Azure Policy. D:Private network tunnels don't enforce deployment JSON conditions.
Question 792 A cloud team wants common compliance controls quickly without writing every rule from scratch. Which approach is sensible? Review and assign relevant built-in Azure Policy definitions Assume every built-in policy is enforced automatically on every subscription Use a storage snapshot as a policy definition Give every developer Owner so policies work Explanation Correct Answer A:Built-in definitions provide reusable governance rules that still require scope decisions. Incorrect Answers B:Available definitions aren't always assigned. C:Snapshots aren't ARM governance JSON. D:Broad access doesn't select compliance controls.
Question 793 A VM has a CostCenter tag and management assumes its public network exposure is now controlled. What should be clarified? Changing a tag always revokes all user permissions Any CostCenter tag functions as a firewall Tags classify resources; a security rule or policy must enforce network restrictions Azure Policy cannot inspect resource properties at all Explanation Correct Answer C:Metadata does not directly deny public ingress. Incorrect Answers A:RBAC is separate from metadata. B:Tags aren't packet filters. D:Policy can assess supported configuration.
Question 794 An auditor wants to compare application resource settings to a predefined group of organizational security controls. What should the platform owner use? A subscription billing alert as a security checklist An assigned Azure Policy initiative with appropriate compliance reporting Only a management-group display name An App Service deployment slot as the initiative Explanation Correct Answer B:A grouped definition can be evaluated as a set of related control checks. Incorrect Answers A:Budgets report spend rather than compliance outcomes. C:Names don't define checks. D:Staging environments aren't policy sets.
Question 795 A company wants to prevent users from deploying unapproved Azure resource types in a sandbox. Which control is suited to the requirement? A VM availability set Azure Blob lifecycle retention alone Azure Policy that restricts allowed resource types A Cost Management chart Explanation Correct Answer C:A policy can deny unsupported resource categories under a selected scope. Incorrect Answers A:Fault domains don't stop unrelated ARM resources. B:Object aging doesn't validate VM or networking type. D:Costs don't enforce which types are permitted.
Question 796 A regulated subscription requires a particular supported managed-disk SKU class for production VMs. What can evaluate or constrain the requested disk configuration? An Azure Policy rule targeting the supported disk SKU property An Entra MFA requirement alone Use VM Size quotas as the enforcement rule for managed disk SKUs A resource tag called PremiumDisk without validation Explanation Correct Answer A:Policies can inspect applicable ARM properties at deployment. Incorrect Answers B:MFA verifies identity, not the selected disk tier. C:Compute quota policies do not directly evaluate whether the storage disk type meets a custom restriction. D:Metadata text doesn't restrict actual disk types.
Question 797 A team changes a noncompliant VM configuration and wants to know whether the assigned Azure Policy now assesses it as compliant. Which step is relevant? Delete the resource group's billing history Inspect only today's resource state and discard prior compliance evaluation records Check updated policy compliance evaluation after the configuration change Assume the old audit finding can never change Explanation Correct Answer C:The current assessment must reflect the corrected resource property. Incorrect Answers A:Cost records don't fix policy state. B:Current state does not provide the historical evidence an auditor requests about earlier noncompliance. D:Compliance may be reevaluated.
Question 798 A team sees an existing VM marked noncompliant with a policy and assumes Azure must immediately delete it. What should be understood? Compliance assessment and deployment denial aren't automatic resource deletion All noncompliant VMs are automatically deleted without owner action Noncompliance always means an active attacker is present Every noncompliant resource becomes public by default Explanation Correct Answer A:Policy flags or blocks matching operations according to its defined effect and evaluation. Incorrect Answers B:Policy doesn't universally destroy existing resources. C:A policy violation isn't necessarily incident evidence. D:The detected rule may concern any property.
Question 799 A platform team introduces a restrictive policy and wants to measure its impact before blocking teams. Which rollout is prudent? Switch all resources to an unrelated region without checking support Give developers unrestricted subscription Owner to avoid policy failures Start with suitable audit/effect evaluation and move to deny after addressing expected impacts Immediately disable every policy evaluation log Explanation Correct Answer C:Observing violations can inform a controlled enforcement transition. Incorrect Answers A:Migration isn't a policy rollout plan. B:Broad access doesn't create safe staged governance. D:Losing evidence hides affected deployments.
Question 800 An application is deployed in an approved Azure region, and management assumes every copy of its data always stays there. What distinction matters? A region restriction automatically proves no geo replication anywhere Assume that allowed-region Azure Policy rules automatically relocate all existing stored data Resource location policy alone doesn't certify all service replication or data processing geography A tag named Local guarantees data residency Explanation Correct Answer C:Data residency depends on individual services and configured redundancy. Incorrect Answers A:Services may have distinct data-location behavior. B:Policy evaluation of resource properties does not itself implement or prove a data-residency migration. D:Metadata isn't storage geography enforcement.
