Question 920 An administrator uses a supported ARM incremental deployment and wants to know whether all unspecified resources are removed by default. What distinction matters? Assume incremental deployment automatically removes all resources absent from the template Every ARM template is a backup restoration job Incremental deployment updates declared resources without generally deleting all unspecified resources Every template run deletes its entire resource group first Explanation Correct Answer C:Deployment behavior depends on mode and supported semantics; omission is not always delete. Incorrect Answers A:Incremental mode generally leaves unspecified existing resources rather than treating them as deletions. B:Deployment isn't a data recovery operation. D:Incremental deployments don't inherently do that.
Question 921 An ARM deployment fails to create a VM because the requested size is unavailable in the selected region. What should be examined? A VM guest OS event log for an instance never created Only the template's file name capitalization Deployment error details, SKU availability and supported alternatives Repeat the same VM deployment in the unavailable region without reviewing quota or SKU availability Explanation Correct Answer C:A failed provider operation may reflect regional supply or quota constraints. Incorrect Answers A:No guest exists to log the failed provisioning. B:Case of an arbitrary filename isn't the regional capacity. D:Repeating an unchanged request cannot resolve an actual unsupported VM size or regional capacity shortage.
Question 922 An ARM what-if output shows deletion of a critical resource that the team did not intend to remove. What is a prudent response? Deploy immediately because previews cannot reveal risks Review deployment scope, mode and template resource set before applying changes Retry the unchanged invalid template without examining the ARM validation details Delete all old source commits to remove ambiguity Explanation Correct Answer B:Unexpected destructive changes require a predeployment explanation. Incorrect Answers A:A warning should inform review. C:Deployment errors should be corrected from the reported schema, permission or dependency failure rather than blindly repeated. D:History is useful for tracing intent.
Question 923 A compliance team wants to trace when a deployment created or modified a resource group. Which Azure control-plane evidence is relevant? Only storage blob access-tier changes Deployment history and Azure Activity Log events at the appropriate scope Save only the current resource screenshot and discard deployment operation history Only a browser's private browsing history Explanation Correct Answer B:ARM records management operations and deployment outcomes. Incorrect Answers A:Object tiering doesn't represent every deployment action. C:A screenshot cannot reconstruct the specific management operation, time or reported result for an audit. D:Local browsing is not the Azure management audit trail.
Question 924 A team deploys a storage account through an ARM template and then changes its public-network setting manually. What should the next deployment review consider? Use floating, unreviewed template dependencies that may change between deployments Whether the template's declared state will overwrite or conflict with the manual change A public IP quota controls storage firewall policy ARM automatically edits the Git repository to match every manual portal change Explanation Correct Answer B:IaC source and live configuration may differ after out-of-band edits. Incorrect Answers A:Deployment consistency requires controlled definitions and parameters, not mutable upstream artifacts. C:Network quota isn't the template's network access configuration. D:Source files aren't universally synchronized.
Question 925 A production template is valid and its operator has Contributor, but resource creation fails due to an Azure Policy assignment. What does this illustrate? Contributor always overrides corporate deny rules Template validation, RBAC authorization and policy compliance are separate gates The VM's OS disk tier determines the user's identity tenant All validated ARM templates are exempt from policy Explanation Correct Answer B:Passing syntax and user permission doesn't bypass an inherited deny policy. Incorrect Answers A:Role grants don't erase compliance enforcement. C:Storage choice is not authorization hierarchy. D:Correct syntax isn't a policy exemption.
Question 926 A platform team connects an external Kubernetes cluster to Azure Arc and wants multiple groups to administer different resources. What needs planning? Turn off audit logging to make access easier Appropriate Arc-enabled access controls and Kubernetes permissions for the supported integration Use Azure subscription Owner to bypass the external cluster's own RBAC Assume every Azure Reader becomes Kubernetes cluster-admin automatically Explanation Correct Answer B:Azure management roles and cluster-native authorization need a defined boundary. Incorrect Answers A:Removing evidence weakens security. C:Azure management roles do not automatically grant every permission within a connected Kubernetes cluster. D:Read-only cloud visibility doesn't confer cluster root access.
Question 927 A server physically runs at a branch, but Azure portal reports its Arc connection as disconnected. What is the best first troubleshooting direction? Increase Blob Storage access tier Move the branch building to an Azure region pair Change its resource group tag to Connected Agent service, identity and outbound service connectivity to Azure endpoints Explanation Correct Answer D:Connection state depends on the agent reaching and authenticating with Azure. Incorrect Answers A:Object temperature isn't the connected agent status. B:Physical location isn't configurable in the portal. C:Text doesn't restore agent heartbeat.
Question 928 A deployment script runs az commands in PowerShell and a teammate insists Azure CLI can only run in Bash. What should the team understand? Assume installing Azure CLI on a laptop automatically grants authorization to resources Azure CLI is a command-line tool callable from supported shells, including PowerShell PowerShell can never invoke an executable named az Azure CLI requires every user to install Linux on their VM Explanation Correct Answer B:Shell syntax differs, but the CLI itself isn't tied to Bash only. Incorrect Answers A:Tool availability does not establish login context or Azure RBAC permission to run write operations. C:Shells can invoke external commands. D:Windows can run supported CLI tools.
Question 929 A newly hired engineer signs in to Azure portal and sees no subscriptions. What should a delegated administrator check? Grant local Windows Administrator on a VM and assume it establishes Azure subscription access Only whether public IP allocation is static Correct tenant selection and whether the identity has subscription/resource access Reinstall the Azure portal browser instead of inspecting current identity and RBAC scope Explanation Correct Answer C:A successful Entra sign-in doesn't guarantee any subscription assignment. Incorrect Answers A:Guest OS permissions are separate from the tenant, subscription and Azure RBAC assignments needed for portal visibility. B:IP strategy isn't subscription visibility. D:A management authorization denial depends on effective grants and policies, not the browser binary alone.
Question 930 A team uses one template for dev and prod but accidentally deploys production connection strings to dev. Which preventive practice fits? Assume the resource group name alone validates all environment variables Embed production passwords in every source template by default Disable deployment logs to hide mismatched settings Use controlled environment-specific parameters and secret retrieval with deployment approvals Explanation Correct Answer D:Explicit input boundaries reduce cross-environment leakage. Incorrect Answers A:Names don't validate configuration content. B:Hardcoding leaks secrets. C:Hiding evidence worsens the problem.
