Microsoft AZ-104 Azure Policy, Locks and Tags Practice Test

 

Topic 03 focuses on Azure Policy, Resource Locks, and Tags for the Microsoft Certified: Azure Administrator Associate certification and the AZ-104 exam, using Microsoft Azure administration scenarios. For broader exam preparation, review the Microsoft Azure Administrator AZ-104 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

To enforce or assess a governance requirement across Azure resources, which Azure configuration should be selected?

1. Azure Policy definition
2. ReadOnly lock
3. Deny policy effect
4. DeployIfNotExists effect

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Policy definition is a rule that describes a resource condition and the effect Azure should apply when the condition is evaluated. It directly supports the requirement to enforce or assess a governance requirement across Azure resources.

Incorrect Answers

Answer B is incorrect because ReadOnly lock is used to make a protected resource effectively read-only at the Azure control plane; it does not provide the capability described in the scenario.

Answer C is incorrect because Deny policy effect is used to prevent noncompliant resource changes from being committed; it does not provide the capability described in the scenario.

Answer D is incorrect because DeployIfNotExists effect is used to automatically add a required supporting configuration after evaluating a resource; it does not provide the capability described in the scenario.

 

Question 2

For Azure Policy definition, which administrative outcome is expected?

1. Manage multiple related governance requirements as one policy set
2. Enforce or assess a governance requirement across Azure resources
3. Classify resources for ownership, environment, cost, automation, or reporting purposes
4. Make a governance rule evaluate resources within a chosen scope

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Policy definition is a rule that describes a resource condition and the effect Azure should apply when the condition is evaluated. Its intended administrative use is to enforce or assess a governance requirement across Azure resources.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Policy initiative, which is used to manage multiple related governance requirements as one policy set; it is not the primary purpose of Azure Policy definition.

Answer C is incorrect because that outcome belongs to Azure resource tag, which is used to classify resources for ownership, environment, cost, automation, or reporting purposes; it is not the primary purpose of Azure Policy definition.

Answer D is incorrect because that outcome belongs to Policy assignment, which is used to make a governance rule evaluate resources within a chosen scope; it is not the primary purpose of Azure Policy definition.

 

Question 3

To manage multiple related governance requirements as one policy set, which Azure configuration should be selected?

1. Policy initiative
2. Policy compliance state
3. Policy assignment
4. ReadOnly lock

Correct Answer: A

 

Correct Answer

Answer A is correct because Policy initiative is a collection of Azure Policy definitions grouped and assigned together. It directly supports the requirement to manage multiple related governance requirements as one policy set.

Incorrect Answers

Answer B is incorrect because Policy compliance state is used to review governance posture and identify resources requiring remediation; it does not provide the capability described in the scenario.

Answer C is incorrect because Policy assignment is used to make a governance rule evaluate resources within a chosen scope; it does not provide the capability described in the scenario.

Answer D is incorrect because ReadOnly lock is used to make a protected resource effectively read-only at the Azure control plane; it does not provide the capability described in the scenario.

 

Question 4

For Policy initiative, which administrative outcome is expected?

1. Classify resources for ownership, environment, cost, automation, or reporting purposes
2. Manage multiple related governance requirements as one policy set
3. Remediate selected resource properties automatically as requests are processed
4. Prevent noncompliant resource changes from being committed

Correct Answer: B

 

Correct Answer

Answer B is correct because Policy initiative is a collection of Azure Policy definitions grouped and assigned together. Its intended administrative use is to manage multiple related governance requirements as one policy set.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Azure resource tag, which is used to classify resources for ownership, environment, cost, automation, or reporting purposes; it is not the primary purpose of Policy initiative.

Answer C is incorrect because that outcome belongs to Modify policy effect, which is used to remediate selected resource properties automatically as requests are processed; it is not the primary purpose of Policy initiative.

Answer D is incorrect because that outcome belongs to Deny policy effect, which is used to prevent noncompliant resource changes from being committed; it is not the primary purpose of Policy initiative.

 

Question 5

To make a governance rule evaluate resources within a chosen scope, which Azure configuration should be selected?

1. Policy compliance state
2. ReadOnly lock
3. Policy assignment
4. CanNotDelete lock

Correct Answer: C

 

Correct Answer

Answer C is correct because Policy assignment is the application of a policy definition or initiative to a management group, subscription, resource group, or resource scope. It directly supports the requirement to make a governance rule evaluate resources within a chosen scope.

Incorrect Answers

Answer A is incorrect because Policy compliance state is used to review governance posture and identify resources requiring remediation; it does not provide the capability described in the scenario.

Answer B is incorrect because ReadOnly lock is used to make a protected resource effectively read-only at the Azure control plane; it does not provide the capability described in the scenario.

Answer D is incorrect because CanNotDelete lock is used to protect critical resources from accidental or unauthorized deletion; it does not provide the capability described in the scenario.

 

Question 6

For Policy assignment, which administrative outcome is expected?

1. Identify resources that violate a governance rule without blocking the operation
2. Handle approved exceptions without removing the policy assignment for everyone else
3. Review governance posture and identify resources requiring remediation
4. Make a governance rule evaluate resources within a chosen scope

Correct Answer: D

 

Correct Answer

Answer D is correct because Policy assignment is the application of a policy definition or initiative to a management group, subscription, resource group, or resource scope. Its intended administrative use is to make a governance rule evaluate resources within a chosen scope.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Audit policy effect, which is used to identify resources that violate a governance rule without blocking the operation; it is not the primary purpose of Policy assignment.

Answer B is incorrect because that outcome belongs to Policy exemption, which is used to handle approved exceptions without removing the policy assignment for everyone else; it is not the primary purpose of Policy assignment.

Answer C is incorrect because that outcome belongs to Policy compliance state, which is used to review governance posture and identify resources requiring remediation; it is not the primary purpose of Policy assignment.

 

Question 7

To prevent noncompliant resource changes from being committed, which Azure configuration should be selected?

1. Policy compliance state
2. Audit policy effect
3. Deny policy effect
4. Policy initiative

Correct Answer: C

 

Correct Answer

Answer C is correct because Deny policy effect is an Azure Policy effect that blocks creation or update of a resource when the policy condition is matched. It directly supports the requirement to prevent noncompliant resource changes from being committed.

Incorrect Answers

Answer A is incorrect because Policy compliance state is used to review governance posture and identify resources requiring remediation; it does not provide the capability described in the scenario.

Answer B is incorrect because Audit policy effect is used to identify resources that violate a governance rule without blocking the operation; it does not provide the capability described in the scenario.

Answer D is incorrect because Policy initiative is used to manage multiple related governance requirements as one policy set; it does not provide the capability described in the scenario.

 

Question 8

For Deny policy effect, which administrative outcome is expected?

1. Protect critical resources from accidental or unauthorized deletion
2. Prevent noncompliant resource changes from being committed
3. Handle approved exceptions without removing the policy assignment for everyone else
4. Identify resources that violate a governance rule without blocking the operation

Correct Answer: B

 

Correct Answer

Answer B is correct because Deny policy effect is an Azure Policy effect that blocks creation or update of a resource when the policy condition is matched. Its intended administrative use is to prevent noncompliant resource changes from being committed.

Incorrect Answers

Answer A is incorrect because that outcome belongs to CanNotDelete lock, which is used to protect critical resources from accidental or unauthorized deletion; it is not the primary purpose of Deny policy effect.

Answer C is incorrect because that outcome belongs to Policy exemption, which is used to handle approved exceptions without removing the policy assignment for everyone else; it is not the primary purpose of Deny policy effect.

Answer D is incorrect because that outcome belongs to Audit policy effect, which is used to identify resources that violate a governance rule without blocking the operation; it is not the primary purpose of Deny policy effect.

 

Question 9

To identify resources that violate a governance rule without blocking the operation, which Azure configuration should be selected?

1. Policy initiative
2. Deny policy effect
3. Audit policy effect
4. Policy exemption

Correct Answer: C

 

Correct Answer

Answer C is correct because Audit policy effect is an Azure Policy effect that allows the resource operation but records noncompliance. It directly supports the requirement to identify resources that violate a governance rule without blocking the operation.

Incorrect Answers

Answer A is incorrect because Policy initiative is used to manage multiple related governance requirements as one policy set; it does not provide the capability described in the scenario.

Answer B is incorrect because Deny policy effect is used to prevent noncompliant resource changes from being committed; it does not provide the capability described in the scenario.

Answer D is incorrect because Policy exemption is used to handle approved exceptions without removing the policy assignment for everyone else; it does not provide the capability described in the scenario.

 

Question 10

For Audit policy effect, which administrative outcome is expected?

1. Review governance posture and identify resources requiring remediation
2. Automatically add a required supporting configuration after evaluating a resource
3. Protect critical resources from accidental or unauthorized deletion
4. Identify resources that violate a governance rule without blocking the operation

Correct Answer: D

 

Correct Answer

Answer D is correct because Audit policy effect is an Azure Policy effect that allows the resource operation but records noncompliance. Its intended administrative use is to identify resources that violate a governance rule without blocking the operation.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Policy compliance state, which is used to review governance posture and identify resources requiring remediation; it is not the primary purpose of Audit policy effect.

Answer B is incorrect because that outcome belongs to DeployIfNotExists effect, which is used to automatically add a required supporting configuration after evaluating a resource; it is not the primary purpose of Audit policy effect.

Answer C is incorrect because that outcome belongs to CanNotDelete lock, which is used to protect critical resources from accidental or unauthorized deletion; it is not the primary purpose of Audit policy effect.

 

Question 11

To remediate selected resource properties automatically as requests are processed, which Azure configuration should be selected?

1. Audit policy effect
2. Azure resource tag
3. Modify policy effect
4. Azure Policy definition

Correct Answer: C

 

Correct Answer

Answer C is correct because Modify policy effect is an Azure Policy effect that can add, update, or remove supported resource properties or tags during create or update. It directly supports the requirement to remediate selected resource properties automatically as requests are processed.

Incorrect Answers

Answer A is incorrect because Audit policy effect is used to identify resources that violate a governance rule without blocking the operation; it does not provide the capability described in the scenario.

Answer B is incorrect because Azure resource tag is used to classify resources for ownership, environment, cost, automation, or reporting purposes; it does not provide the capability described in the scenario.

Answer D is incorrect because Azure Policy definition is used to enforce or assess a governance requirement across Azure resources; it does not provide the capability described in the scenario.

 

Question 12

For Modify policy effect, which administrative outcome is expected?

1. Remediate selected resource properties automatically as requests are processed
2. Manage multiple related governance requirements as one policy set
3. Protect critical resources from accidental or unauthorized deletion
4. Prevent noncompliant resource changes from being committed

Correct Answer: A

 

Correct Answer

Answer A is correct because Modify policy effect is an Azure Policy effect that can add, update, or remove supported resource properties or tags during create or update. Its intended administrative use is to remediate selected resource properties automatically as requests are processed.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Policy initiative, which is used to manage multiple related governance requirements as one policy set; it is not the primary purpose of Modify policy effect.

Answer C is incorrect because that outcome belongs to CanNotDelete lock, which is used to protect critical resources from accidental or unauthorized deletion; it is not the primary purpose of Modify policy effect.

Answer D is incorrect because that outcome belongs to Deny policy effect, which is used to prevent noncompliant resource changes from being committed; it is not the primary purpose of Modify policy effect.

 

Question 13

To automatically add a required supporting configuration after evaluating a resource, which Azure configuration should be selected?

1. Deny policy effect
2. Modify policy effect
3. DeployIfNotExists effect
4. Audit policy effect

Correct Answer: C

 

Correct Answer

Answer C is correct because DeployIfNotExists effect is an Azure Policy effect that can deploy a related resource when the required configuration is missing. It directly supports the requirement to automatically add a required supporting configuration after evaluating a resource.

Incorrect Answers

Answer A is incorrect because Deny policy effect is used to prevent noncompliant resource changes from being committed; it does not provide the capability described in the scenario.

Answer B is incorrect because Modify policy effect is used to remediate selected resource properties automatically as requests are processed; it does not provide the capability described in the scenario.

Answer D is incorrect because Audit policy effect is used to identify resources that violate a governance rule without blocking the operation; it does not provide the capability described in the scenario.

 

Question 14

For DeployIfNotExists effect, which administrative outcome is expected?

1. Make a governance rule evaluate resources within a chosen scope
2. Automatically add a required supporting configuration after evaluating a resource
3. Remediate selected resource properties automatically as requests are processed
4. Manage multiple related governance requirements as one policy set

Correct Answer: B

 

Correct Answer

Answer B is correct because DeployIfNotExists effect is an Azure Policy effect that can deploy a related resource when the required configuration is missing. Its intended administrative use is to automatically add a required supporting configuration after evaluating a resource.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Policy assignment, which is used to make a governance rule evaluate resources within a chosen scope; it is not the primary purpose of DeployIfNotExists effect.

Answer C is incorrect because that outcome belongs to Modify policy effect, which is used to remediate selected resource properties automatically as requests are processed; it is not the primary purpose of DeployIfNotExists effect.

Answer D is incorrect because that outcome belongs to Policy initiative, which is used to manage multiple related governance requirements as one policy set; it is not the primary purpose of DeployIfNotExists effect.

 

Question 15

To handle approved exceptions without removing the policy assignment for everyone else, which Azure configuration should be selected?

1. Azure resource tag
2. Policy exemption
3. Modify policy effect
4. Policy compliance state

Correct Answer: B

 

Correct Answer

Answer B is correct because Policy exemption is a scoped exception that marks selected resources or hierarchy as exempt from an assigned policy or initiative. It directly supports the requirement to handle approved exceptions without removing the policy assignment for everyone else.

Incorrect Answers

Answer A is incorrect because Azure resource tag is used to classify resources for ownership, environment, cost, automation, or reporting purposes; it does not provide the capability described in the scenario.

Answer C is incorrect because Modify policy effect is used to remediate selected resource properties automatically as requests are processed; it does not provide the capability described in the scenario.

Answer D is incorrect because Policy compliance state is used to review governance posture and identify resources requiring remediation; it does not provide the capability described in the scenario.

 

Question 16

For Policy exemption, which administrative outcome is expected?

1. Remediate selected resource properties automatically as requests are processed
2. Make a governance rule evaluate resources within a chosen scope
3. Handle approved exceptions without removing the policy assignment for everyone else
4. Automatically add a required supporting configuration after evaluating a resource

Correct Answer: C

 

Correct Answer

Answer C is correct because Policy exemption is a scoped exception that marks selected resources or hierarchy as exempt from an assigned policy or initiative. Its intended administrative use is to handle approved exceptions without removing the policy assignment for everyone else.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Modify policy effect, which is used to remediate selected resource properties automatically as requests are processed; it is not the primary purpose of Policy exemption.

Answer B is incorrect because that outcome belongs to Policy assignment, which is used to make a governance rule evaluate resources within a chosen scope; it is not the primary purpose of Policy exemption.

Answer D is incorrect because that outcome belongs to DeployIfNotExists effect, which is used to automatically add a required supporting configuration after evaluating a resource; it is not the primary purpose of Policy exemption.

 

Question 17

To review governance posture and identify resources requiring remediation, which Azure configuration should be selected?

1. Audit policy effect
2. Modify policy effect
3. Policy initiative
4. Policy compliance state

Correct Answer: D

 

Correct Answer

Answer D is correct because Policy compliance state is the result that indicates whether a resource meets the policy rules that apply to it. It directly supports the requirement to review governance posture and identify resources requiring remediation.

Incorrect Answers

Answer A is incorrect because Audit policy effect is used to identify resources that violate a governance rule without blocking the operation; it does not provide the capability described in the scenario.

Answer B is incorrect because Modify policy effect is used to remediate selected resource properties automatically as requests are processed; it does not provide the capability described in the scenario.

Answer C is incorrect because Policy initiative is used to manage multiple related governance requirements as one policy set; it does not provide the capability described in the scenario.

 

Question 18

For Policy compliance state, which administrative outcome is expected?

1. Make a protected resource effectively read-only at the Azure control plane
2. Make a governance rule evaluate resources within a chosen scope
3. Identify resources that violate a governance rule without blocking the operation
4. Review governance posture and identify resources requiring remediation

Correct Answer: D

 

Correct Answer

Answer D is correct because Policy compliance state is the result that indicates whether a resource meets the policy rules that apply to it. Its intended administrative use is to review governance posture and identify resources requiring remediation.

Incorrect Answers

Answer A is incorrect because that outcome belongs to ReadOnly lock, which is used to make a protected resource effectively read-only at the Azure control plane; it is not the primary purpose of Policy compliance state.

Answer B is incorrect because that outcome belongs to Policy assignment, which is used to make a governance rule evaluate resources within a chosen scope; it is not the primary purpose of Policy compliance state.

Answer C is incorrect because that outcome belongs to Audit policy effect, which is used to identify resources that violate a governance rule without blocking the operation; it is not the primary purpose of Policy compliance state.

 

Question 19

To protect critical resources from accidental or unauthorized deletion, which Azure configuration should be selected?

1. Audit policy effect
2. CanNotDelete lock
3. Azure resource tag
4. Policy initiative

Correct Answer: B

 

Correct Answer

Answer B is correct because CanNotDelete lock is a resource lock that permits authorized updates but blocks deletion of the locked scope or protected resources. It directly supports the requirement to protect critical resources from accidental or unauthorized deletion.

Incorrect Answers

Answer A is incorrect because Audit policy effect is used to identify resources that violate a governance rule without blocking the operation; it does not provide the capability described in the scenario.

Answer C is incorrect because Azure resource tag is used to classify resources for ownership, environment, cost, automation, or reporting purposes; it does not provide the capability described in the scenario.

Answer D is incorrect because Policy initiative is used to manage multiple related governance requirements as one policy set; it does not provide the capability described in the scenario.

 

Question 20

For CanNotDelete lock, which administrative outcome is expected?

1. Protect critical resources from accidental or unauthorized deletion
2. Manage multiple related governance requirements as one policy set
3. Automatically add a required supporting configuration after evaluating a resource
4. Prevent noncompliant resource changes from being committed

Correct Answer: A

 

Correct Answer

Answer A is correct because CanNotDelete lock is a resource lock that permits authorized updates but blocks deletion of the locked scope or protected resources. Its intended administrative use is to protect critical resources from accidental or unauthorized deletion.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Policy initiative, which is used to manage multiple related governance requirements as one policy set; it is not the primary purpose of CanNotDelete lock.

Answer C is incorrect because that outcome belongs to DeployIfNotExists effect, which is used to automatically add a required supporting configuration after evaluating a resource; it is not the primary purpose of CanNotDelete lock.

Answer D is incorrect because that outcome belongs to Deny policy effect, which is used to prevent noncompliant resource changes from being committed; it is not the primary purpose of CanNotDelete lock.

 

Question 21

To make a protected resource effectively read-only at the Azure control plane, which Azure configuration should be selected?

1. ReadOnly lock
2. Audit policy effect
3. Azure Policy definition
4. Policy compliance state

Correct Answer: A

 

Correct Answer

Answer A is correct because ReadOnly lock is a resource lock that permits read operations but blocks changes that require write or delete operations. It directly supports the requirement to make a protected resource effectively read-only at the Azure control plane.

Incorrect Answers

Answer B is incorrect because Audit policy effect is used to identify resources that violate a governance rule without blocking the operation; it does not provide the capability described in the scenario.

Answer C is incorrect because Azure Policy definition is used to enforce or assess a governance requirement across Azure resources; it does not provide the capability described in the scenario.

Answer D is incorrect because Policy compliance state is used to review governance posture and identify resources requiring remediation; it does not provide the capability described in the scenario.

 

Question 22

For ReadOnly lock, which administrative outcome is expected?

1. Make a governance rule evaluate resources within a chosen scope
2. Manage multiple related governance requirements as one policy set
3. Automatically add a required supporting configuration after evaluating a resource
4. Make a protected resource effectively read-only at the Azure control plane

Correct Answer: D

 

Correct Answer

Answer D is correct because ReadOnly lock is a resource lock that permits read operations but blocks changes that require write or delete operations. Its intended administrative use is to make a protected resource effectively read-only at the Azure control plane.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Policy assignment, which is used to make a governance rule evaluate resources within a chosen scope; it is not the primary purpose of ReadOnly lock.

Answer B is incorrect because that outcome belongs to Policy initiative, which is used to manage multiple related governance requirements as one policy set; it is not the primary purpose of ReadOnly lock.

Answer C is incorrect because that outcome belongs to DeployIfNotExists effect, which is used to automatically add a required supporting configuration after evaluating a resource; it is not the primary purpose of ReadOnly lock.

 

Question 23

To classify resources for ownership, environment, cost, automation, or reporting purposes, which Azure configuration should be selected?

1. Azure resource tag
2. Azure Policy definition
3. Deny policy effect
4. Policy assignment

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure resource tag is a name-value metadata pair applied to supported Azure resources, resource groups, or subscriptions. It directly supports the requirement to classify resources for ownership, environment, cost, automation, or reporting purposes.

Incorrect Answers

Answer B is incorrect because Azure Policy definition is used to enforce or assess a governance requirement across Azure resources; it does not provide the capability described in the scenario.

Answer C is incorrect because Deny policy effect is used to prevent noncompliant resource changes from being committed; it does not provide the capability described in the scenario.

Answer D is incorrect because Policy assignment is used to make a governance rule evaluate resources within a chosen scope; it does not provide the capability described in the scenario.

 

Question 24

For Azure resource tag, which administrative outcome is expected?

1. Make a protected resource effectively read-only at the Azure control plane
2. Enforce or assess a governance requirement across Azure resources
3. Manage multiple related governance requirements as one policy set
4. Classify resources for ownership, environment, cost, automation, or reporting purposes

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure resource tag is a name-value metadata pair applied to supported Azure resources, resource groups, or subscriptions. Its intended administrative use is to classify resources for ownership, environment, cost, automation, or reporting purposes.

Incorrect Answers

Answer A is incorrect because that outcome belongs to ReadOnly lock, which is used to make a protected resource effectively read-only at the Azure control plane; it is not the primary purpose of Azure resource tag.

Answer B is incorrect because that outcome belongs to Azure Policy definition, which is used to enforce or assess a governance requirement across Azure resources; it is not the primary purpose of Azure resource tag.

Answer C is incorrect because that outcome belongs to Policy initiative, which is used to manage multiple related governance requirements as one policy set; it is not the primary purpose of Azure resource tag.