Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Enforcing Allowed Locations with Azure Policy
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization wants to ensure that all cloud resources are deployed only to approved geographic regions in order to satisfy regulatory and data residency standards. The Azure administrator needs to enforce this rule across an entire subscription using a pre-configured rule without writing custom JSON code.
What should the administrator do to meet this requirement?
Explanations
Apply a Read-Only resource lock to the subscription
Apply a Read-Only resource lock to the subscription
What Resource Locks Are and Do
Resource locks are management safeguards in Azure that prevent accidental deletion or modification of critical Azure resources. Locks can be configured as ReadOnly (preventing any changes or writes) or CanNotDelete (allowing changes but preventing deletion).
Why It Doesn't Meet the Requirement
- Blocks all resource creation: Applying a
ReadOnlylock at the subscription scope prevents users and administrators from creating or modifying any resources, effectively freezing the entire subscription. - Lacks conditional logic: Resource locks cannot selectively allow deployments in specific regions while blocking others.
- No compliance evaluation: Locks do not evaluate properties or configurations of deployed resources.
Key Characteristics and Limitations
- Functions as an override on user permissions to protect critical infrastructure.
- Does not support parameter-based filtering or geographic restrictions.
- Applies uniformly to all operations under the locked scope without condition-based checks.
This Answer Would Be Correct If
The requirement was to prevent any administrator or automated script from accidentally deleting or modifying a critical production virtual network or database.
Additional Context
Resource locks are intended for resource protection rather than compliance enforcement and policy governance.
Configure an Azure role-based access control (Azure RBAC) custom role assignment
Configure an Azure role-based access control (Azure RBAC) custom role assignment
What Azure RBAC Is and Does
Azure role-based access control (Azure RBAC) is an authorization mechanism used to manage user access and permissions to Azure resources. It determines who has permission to perform specific management operations (such as creating, modifying, or deleting resources) based on assigned roles.
Why It Doesn't Meet the Requirement
- Focuses on identity rather than resource configuration: Azure RBAC controls what actions an identity can execute, but it does not evaluate or restrict specific resource properties, such as the geographic region or location of a resource.
- Cannot evaluate deployment regions: Even if a user has permission to deploy virtual machines, RBAC cannot selectively restrict those deployments based on location properties.
- Requires custom role management: Defining custom RBAC roles would require creating custom JSON permission manifests, which contradicts the goal of using pre-configured governance rules.
Key Characteristics and Limitations
- Enforces authorization based on user, group, or service principal identity.
- Grants permissions via control plane actions (for example,
Microsoft.Compute/virtualMachines/write). - Does not enforce corporate standards or evaluate resource configuration properties.
This Answer Would Be Correct If
The organization needed to grant specific developers the ability to create virtual machines while preventing them from modifying network security groups or deleting subscriptions.
Additional Context
While RBAC determines who can access a resource, Azure Policy ensures that the state and properties of resources meet organizational standards regardless of who initiates the deployment.
Assign a built-in Azure Policy definition to the subscription scope
Assign a built-in Azure Policy definition to the subscription scope
What Azure Policy and Built-In Definitions Are
Azure Policy is a dedicated governance service in Microsoft Azure that allows organizations to define, assess, and enforce corporate standards and regulatory compliance across their cloud environments. Azure Policy compares resource configurations against defined business logic. To accelerate governance, Azure provides built-in policy definitions—pre-configured rules created by Microsoft that address standard use cases such as enforcing naming conventions, requiring resource tags, or restricting deployments to allowed geographic locations.
How It Meets the Requirement
- Pre-configured rules: Azure includes a built-in policy definition named Allowed locations that enables administrators to select permitted regions from a list of parameters without writing custom JSON definitions.
- Scope-level enforcement: Policy definitions can be assigned to various Resource Manager scopes, including management groups, subscriptions, resource groups, or individual resources. Assigning the policy at the subscription scope automatically applies the rule to all current and future deployments within that entire subscription.
- Preventive enforcement: By setting the policy effect to
Deny, Azure Resource Manager blocks any deployment request targeting an unapproved region during resource creation or update.
Key Advantages and Capabilities
- Zero custom code required: Pre-built policy templates eliminate the need to write and validate complex JSON schemas manually.
- Scalable governance: Policies inherit down through the resource hierarchy, applying uniformly across all resource groups under the assigned subscription.
- Real-time evaluation: Evaluates requests immediately when resources are created or updated, preventing non-compliant deployments before they occur.
- Centralized visibility: Provides a compliance dashboard displaying overall organizational compliance status.
Why This Is Optimal
Assigning a built-in policy is the native, intended method for enforcing cloud governance and resource configurations at scale across Azure scopes.
Configure an Azure Blob Storage lifecycle management policy
Configure an Azure Blob Storage lifecycle management policy
What Lifecycle Management Is and Does
Azure Blob Storage lifecycle management is a rule-based data management feature within Azure Storage. It automates transitioning blob data between access tiers (Hot, Cool, Cold, and Archive) and deletes expired data based on defined age and usage conditions.
Why It Doesn't Meet the Requirement
- Applies only to storage data: Lifecycle management policies operate exclusively on blob data stored inside Azure Storage accounts.
- Cannot govern Azure subscriptions: It cannot evaluate, restrict, or manage Azure Resource Manager deployments across an entire subscription.
- Unrelated to geographic deployment rules: It manages data retention and tiering schedules rather than geographic placement of cloud resources.
Key Characteristics and Limitations
- Configured at the individual storage account level.
- Triggers actions based on blob creation, last modification, or last access dates.
- Designed for cost optimization and automated retention management of unstructured data.
This Answer Would Be Correct If
The organization needed to automatically move diagnostic log files to cold or archive storage after 30 days to reduce storage expenses.
Additional Context
Storage lifecycle rules are workload-specific data management configurations, completely separate from Azure-wide governance tools like Azure Policy.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Initiative Definition
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Remediation Tasks
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Compliance Enforcement
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Templates Declarative IaC
Describe infrastructure as code (IaC)
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated