Microsoft - AZ-104: Microsoft Azure Administrator

Sample Questions

Explanation:

Each policy definition in Azure Policy has a single effect in its policyRule. That effect determines what happens when the policy rule is evaluated to match. The effects behave differently if they are for a new resource, an updated resource, or an existing resource.

Similar to auditIfNotExists, a deployIfNotExists policy definition executes a template deployment when the condition is met. Policy assignments with effect set as DeployIfNotExists require a managed identity to do remediation.

deployIfNotExists runs after a configurable delay when a Resource Provider handles a create or update subscription or resource request and returned a success status code. A template deployment occurs if there are no related resources or if the resources defined by existenceCondition don't evaluate to true.

To ensure that the policy applies to all virtual machines in Sub1, we have to assign the policy to Sub1.

References:

What is Azure Policy?

Azure Policy definitions effect basics

Azure Policy definitions deployIfNotExists effect

Explanation:

Admin1 has the Network Contributor role assigned for Sub1. The Network Contributor allows Admin1 to manage virtual networks in Sub1, but does not grant access to them.

The deny assignment added by the deployment stack Deployment1 prevents all users including owners from deleting VNet2 (-DenySettingsMode DenyDelete) but does not prevent modifications. If DenySettingsMode were set to DenyWriteAndDelete Admin1 could not modify the IP address space of VNet2.

Reference: List Azure deny assignments

Explanation:

User2 is a guest user from the fabrikam.com tenant. User2 has no role assigned in the contoso.com tenant. Guest user access is restricted to properties and memberships of their own directory objects. User2 cannot view any properties of User1.

Anyone in the organization can invite guest users including guests and non-admins. User2 can invite a user named user3@northwindtraders.com to collaborate.

User2 cannot create a Microsoft 365 group in the contoso.com tenant. User2 must have at least the Groups Administrator or User Administrator role assigned to create groups.

References:

Configure external collaboration settings for B2B in Microsoft Entra External ID

Manage Microsoft Entra groups and group membership

Groups least privileged roles

• Control costs by limiting the number of high-cost resources that can be provisioned in the subscriptions.
• Group all the resources by application for cost reporting.
• Control costs by monitoring resource usage.

Explanation:

To limit the number of high-cost resources that can be provisioned, we should make use of Azure Policy. Azure Policy evaluates resources and actions in Azure by comparing the properties of those resources to business rules. These business rules, described in JSON format, are known as policy definitions. Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started. 

The following are examples for policy definitions that can help to control costs by limiting high-cost resources:

• Not Allowed Resource Types
• Allowed virtual machine size SKUs
• Allowed App Services Plan SKUs

To group resources by application for cost reporting, we should add tags to the resources. Tags are metadata elements that you apply to your Azure resources. They are key-value pairs that help you identify resources based on settings that are relevant to your organization. If you want to track the deployment environment for your resources, add a key named Environment. To identify the resources deployed to production, give them a value of Production. The full key-value pair is Environment = Production.

To control costs by monitoring resource usage, we should implement a budget. Budgets are commonly used as part of cost control. Budgets can be scoped in Azure. For instance, you could narrow your budget view based on subscription, resource groups, or a collection of resources. Besides using the budgets API to send email notifications when a budget threshold is reached, you can also use Azure Monitor action groups. Action groups trigger a coordinated set of actions in response to a budget event.

References:

What is Azure Policy?

Use tags to organize your Azure resources and management hierarchy

Manage costs with budgets

Explanation:

When deploying resources, you may need to make sure some resources exist before other resources. For example, you need a logical SQL server before deploying a database. You establish this relationship by marking one resource as dependent on the other resource. Use the dependsOn element to define an explicit dependency.

First and second, we need to create the virtual network (VNet1) and the public IP address (PIP1). It doesn't matter which of the two resources we create first as they don't directly depend on each other. But, both must exist before a the network interface (NIC1) can use them.

Third, we create the network interface (NIC1). The network interface requires a subnet within a virtual network and an IP address to be configured before it can be created.

Lastly, we create the virtual machine (VM1). The VM requires the network interface to connect to the virtual network.

Reference: Define the order for deploying resources in ARM templates