Question 850 An engineer can run Azure CLI commands in Cloud Shell but receives authorization errors when attempting to create a VM. What principle applies? All Cloud Shell sessions run as subscription Owner Cloud Shell does not bypass the signed-in principal's Azure RBAC and policy restrictions An Azure resource tag named Admin grants VM creation Switching to Bash always overrides denial Explanation Correct Answer B:Terminal availability is not a privilege grant. Incorrect Answers A:Shell access doesn't automatically elevate roles. C:Tags aren't role assignments. D:Shell choice doesn't bypass authorization.
Question 851 An operator uses Cloud Shell for an occasional command and assumes the terminal itself is a permanent production application host. What distinction matters? Closing the browser makes every Azure resource stop Keep the interactive Cloud Shell session open indefinitely instead of deploying a hosted workload A Cloud Shell tab automatically deploys a VM for every command Cloud Shell is an interactive management environment, not a production hosting platform Explanation Correct Answer D:Workloads belong on suitable Azure compute resources, not a temporary administration terminal. Incorrect Answers A:Azure resources have independent lifecycles. B:Cloud Shell is designed for temporary management sessions, not reliable production application hosting. C:A shell doesn't create resources unless commands request them.
Question 852 A cloud administrator needs to run a short script that lists resources across a subscription while traveling. Which workflow is suitable? Change every resource's tag to 'listed' without reading its properties Record the desired changes as manual click instructions instead of an executable script Use a storage account access tier as the script interpreter Use Azure Cloud Shell with an authenticated Azure management script Explanation Correct Answer D:The shell runs supported tools from a browser session. Incorrect Answers A:Blind tagging isn't an inventory report. B:Manual notes do not provide repeatable CLI automation for the intended resource updates. C:Object tiers don't execute commands.
Question 853 A user stores a small administration script in a Cloud Shell session and wants to reuse it later. What should they consider? Store executable scripts solely as transient terminal command history Supported persistent file storage and session persistence behavior Assume all temporary process memory persists forever Create a VM availability set named ScriptBackup Explanation Correct Answer B:Cloud Shell session lifecycles and mounted storage affect what remains available. Incorrect Answers A:History is not a durable, reviewed place to manage scripts used in repeated deployments. C:Transient sessions don't guarantee indefinite process state. D:Compute placement isn't a shell script repository.
Question 854 An operations team uses Linux build agents but wants to automate Azure resource management without Windows PowerShell dependencies. Which command-line tooling fits? Use the Azure portal's graphical interface as though it were a cross-platform az executable Azure Storage Archive tier Azure CLI, using az commands Only the Windows Azure portal GUI Explanation Correct Answer C:Azure CLI works across supported platforms and environments. Incorrect Answers A:The portal is useful but does not provide the same command syntax for shell automation. B:A storage tier doesn't run deployment commands. D:The portal is a web interface, not a Linux scripting CLI.
Question 855 A script must retrieve an inventory of resources in a subscription using Azure CLI. Which kind of command should it use? A VM guest disk formatter Try to enumerate all resource groups by inspecting only a single VM A Blob lifecycle expiration command An appropriate az resource list or service-specific list operation Explanation Correct Answer D:CLI list operations query ARM resources visible to the principal. Incorrect Answers A:Disk formatting doesn't query cloud resources. B:One VM cannot reveal every resource group visible at the active subscription scope. C:Object policy isn't a subscription resource list.
Question 856 A deployment pipeline needs to create an Azure resource group before provisioning VMs. Which Azure CLI command family addresses the operation? A guest OS directory creation command alone An Azure Data Box shipment request az group create with the intended subscription and location Create a VM first and assume that implicitly creates the named independent resource group Explanation Correct Answer C:CLI group commands manage resource-group containers. Incorrect Answers A:Local folders aren't Azure resource groups. B:Data transport doesn't create the ARM group. D:Resource-group management is an ARM operation that must use an appropriate command or deployment definition.
Question 857 A team wants the same Azure resource configuration deployed through CI rather than manually clicking portal forms. Which Azure CLI pattern supports the goal? Depend on manually repeated portal clicks without storing resource definitions or scripts Script supported az deployment or resource commands with source-controlled inputs Change resource display names randomly during each build Keep screenshots of the portal wizard without executable instructions Explanation Correct Answer B:CLI automation can repeatedly apply desired Azure configuration. Incorrect Answers A:Click-by-click creation does not provide the requested automated, repeatable deployment procedure. C:Random names don't ensure desired state. D:Screenshots cannot enact repeatable deployments.
Question 858 A pipeline uses Azure CLI in unattended automation and must avoid a human operator's password. Which approach should it evaluate? Use the build agent's hostname as authentication Hardcode a subscription Owner password in the repository A supported workload identity or service principal with least-privilege authorization Enable anonymous ARM write access Explanation Correct Answer C:Automation can authenticate using a dedicated non-human principal. Incorrect Answers A:Names aren't bearer tokens. B:Embedded privileged credentials create serious risk. D:Unrestricted cloud management is not supported or safe.
Question 859 An automation accidentally deploys test resources into production. Which Azure CLI practice can reduce this mistake? Disable deployment logs to reduce noise Set only an environment variable named SUBSCRIPTION in a script without selecting the Azure CLI context Use identical names for test and production subscriptions Explicitly set and verify the intended subscription/account context Explanation Correct Answer D:Scripts should not rely on an ambiguous default tenant/subscription. Incorrect Answers A:Lack of logs doesn't prevent wrong-target writes. B:The Azure CLI's active account context determines where operations run unless commands explicitly specify scope. C:Identical labels can increase ambiguity.
Question 860 A build system consumes Azure CLI command results programmatically. Which output choice helps avoid fragile screen scraping? Copy raw command output into manually edited text files for each later step Use a supported structured output format such as JSON with targeted queries Take screenshots of terminal output and OCR them on every run Always use the portal's visible chart colors as an API Explanation Correct Answer B:Machine-readable output is more reliable than parsing decorative text. Incorrect Answers A:Manual parsing is fragile; structured CLI output can be consumed directly by automation. C:Screenshots are brittle for machine parsing. D:Graphics aren't stable structured results.
