Manage Azure subscriptions and governance

Marlowe Consulting employs a FinOps analyst who must be able to add, change, and remove tags on any resource in subscription Sub-Projects so that chargeback reports are accurate. The analyst must not be able to change any other property of the resources, start or stop virtual machines, or delete anything. Least privilege is required.

Which built-in role should you assign to the analyst at the Sub-Projects scope?

1. ATag ContributorTag Contributor allows managing tags on resources and resource groups through the Microsoft.Resources/tags/* operations without granting access to modify the resources themselves.
2. BContributorContributor can change every property of every resource and delete resources, which is far beyond tag management.
3. CReaderReader cannot write tags; tag updates are write operations against the resource or the tags resource.
4. DCost Management ContributorCost Management Contributor manages budgets, exports, and cost views; it does not grant permission to write tags on resources.

Coralbrook Labs has a monthly budget of 5,000 USD for resource group RG-Research in subscription Sub-Science. The lab manager created an Azure budget scoped to RG-Research with an alert at 80 percent of the amount, sent to the manager's email. The manager expects Azure to shut down the virtual machines in RG-Research automatically when spending reaches 5,000 USD.

Which statement correctly describes what the budget will do?

1. AThe budget sends an email when actual cost reaches 4,000 USD and does nothing else; it never stops or deletes resources.Budgets in Cost Management are notification tools that trigger alerts, emails, and optionally action groups at thresholds; they do not enforce spending caps or change resources on their own.
2. BThe budget deallocates all virtual machines in RG-Research when cost reaches 5,000 USD.A budget has no built-in enforcement; stopping VMs requires an action group with automation, such as an Azure Automation runbook or Azure Function, attached to the budget alert.
3. CThe budget blocks new deployments into RG-Research once cost reaches 5,000 USD.Blocking deployments is an Azure Policy or lock function; budgets cannot deny requests.
4. DThe budget cannot be scoped to a resource group and will track the whole subscription.Budgets can be scoped to management groups, subscriptions, resource groups, and filtered further by tags or other dimensions.

Elmcrest Software wants to understand how many virtual machines in subscription Sub-Eng use unmanaged disks before deciding on a migration plan. The platform team must not block any deployments and must not change any existing virtual machine during this discovery phase. They want the results visible on the Azure Policy compliance dashboard.

Which policy effect should the assigned definition use?

1. AAuditAudit evaluates resources and records non-compliance on the compliance dashboard without blocking or changing anything, which is exactly a discovery-phase requirement.
2. BDenyDeny would block any new or updated VM that uses unmanaged disks, which violates the requirement not to block deployments.
3. CDeployIfNotExistsDeployIfNotExists deploys additional resources to fix non-compliance, which is a change to the environment that the discovery phase forbids.
4. DDisabledDisabled turns the policy off entirely, so nothing is evaluated and the dashboard shows no results.

Juniper Hospitality created resource group RG-Booking and tagged it with Environment=Production. A developer then deploys a virtual machine named vm-book01 and a storage account named stbook01 into RG-Booking without specifying any tags. The finance team later filters Cost analysis by the tag Environment=Production and sees no cost for vm-book01 or stbook01.

Why do the resources not appear in the filtered cost view?

1. ATags applied to a resource group are not inherited by the resources inside it, so vm-book01 and stbook01 have no Environment tag.Resource group tags apply only to the resource group object; each resource must carry its own tags for cost analysis filtering unless a Modify policy or tag inheritance setting propagates them.
2. BCost analysis only supports filtering by tags on resources created through Bicep.Cost analysis filters on tags regardless of how the resource was created.
3. CVirtual machines and storage accounts do not support tags.Both resource types fully support tags; the issue is that none were applied.
4. DTags are case-sensitive and the finance team typed Production in the wrong case.Tag names are case-insensitive and tag values are preserved as entered; the scenario states the resources were deployed without any tags at all.