Microsoft AZ-900 - Questions & Answers

Azure Files is Microsoft's easy-to-use cloud file system. Azure file shares can be seamlessly used in Windows and Windows Server.
To use an Azure file share with Windows, you must either mount it, which means assigning it a drive letter or mount point path, or access it via its UNC path.

Unlike other SMB shares you may have interacted with, such as those hosted on a Windows Server, Linux Samba server, or NAS device, Azure file shares do not currently support Kerberos authentication with your Active Directory (AD) or Azure Active Directory (AAD) identity, although this is a feature we are working on. Instead, you must access your Azure file share with the storage account key for the storage account containing your Azure file share. A storage account key is an administrator key for a storage account, including administrator permissions to all files and folders within the file share you're accessing, and for all file shares and other storage resources (blobs, queues, tables, etc) contained within your storage account.

References:
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows

Azure allows most resources, including virtual machines, to be moved between subscriptions as long as both subscriptions are under the same Azure Active Directory (Azure AD) tenant.

References:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription
"You can move resources to a new subscription as long as the source and destination subscriptions belong to the same Azure Active Directory tenant." Why the Other Answers Are Incorrect: No change is needed-Incorrect.-Azure DOES allow resources, including virtual machines, to be moved between subscriptions. The virtual machines can be moved to the new subscription only if they are all in the same resource group-Incorrect.-Virtual machines do NOT need to be in the same resource group to be moved to another subscription. Microsoft Learn Reference: (https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription)
"Resources can be moved individually or as a group." The virtual machines can be moved to the new subscription only if they run Windows Server 2016-Incorrect. Operating system type does NOT affect whether a VM can be moved between subscriptions. Both Windows and Linux virtual machines support subscription moves. References: (https://docs.microsoft.com/en-us/azure/virtual-machines/windows/move-vm)

The VNet will be marked as `Non-compliant' when the policy is assigned. However, it will not be deleted and will continue to function normally.
Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements.
If there are any existing resources that aren't compliant with a new policy assignment, they appear under Non-compliant resources.

References:
https://docs.microsoft.com/en-us/azure/governance/policy/overview
https://docs.microsoft.com/en-us/azure/governance/policy/assign-policy-portal

Management groups are the Azure feature for managing compliance across multiple subscriptions, while resource groups are logical containers for resources within a single subscription. To manage compliance at scale, organizations should use management groups to apply policies and access controls to a collection of subscriptions. Resource Groups Function: Act as logical containers to group related resources like virtual machines, storage accounts, and web apps that share the same lifecycle, permissions, and policies.
Scope: Limited to a single subscription.
Compliance: Compliance is managed at the subscription level or for resources within the group, not across multiple subscriptions using only resource groups.

Management Groups Function: Provide a level of governance above subscriptions. They allow you to manage access, policies, and compliance for multiple subscriptions at once.
Scope: Can contain other management groups and subscriptions, allowing for the creation of a hierarchy.
Compliance: By applying Azure Policy or role-based access controls at the management group level, you can enforce compliance standards across all subscriptions within that group.

How they work together
To effectively manage compliance across multiple subscriptions, you would place your subscriptions under a management group. Then, you would apply a policy or governance standard to that management group, and the policy would be enforced on all subscriptions and their resources within that group. Resource groups still exist within individual subscriptions, but their management is now part of the broader governance applied at the management group level.

(Management groups) provide organizations with the ability to manage the compliance of Azure resources across multiple subscriptions.

Reasoning: Management groups allow you to organize multiple Azure subscriptions into a hierarchy for unified management, including policy enforcement and compliance tracking.
Resource groups are limited to organizing resources within a single subscription and cannot manage compliance across multiple subscriptions.
Other options: "No change is needed" . Incorrect. Resource groups do not span multiple subscriptions, so they cannot enforce compliance across subscriptions.- "Azure policies" . Partially correct. Azure Policy is used to enforce compliance but must be applied at a scope such as management groups, subscriptions, or resource groups. Policies alone do not provide cross-subscription management without management groups.-"Azure App Service plans" . Incorrect. App Service plans are used to host web apps and do not provide compliance management.
References:
Microsoft Learn: (https://learn.microsoft.com/en-us/azure/governance/management-groups/overview)
"Management groups provide a level of scope above subscriptions. You organize subscriptions into containers called 'management groups' and apply your governance conditions to the management groups."-Microsoft Learn: (https://learn.microsoft.com/en-us/azure/governance/policy/overview)
"Azure Policy helps enforce organizational standards and assess compliance, and it can be applied at management group scope to span multiple subscriptions."

Azure Activity Log provides a record of all management operations performed on resources in Azure, including who started, stopped, or deleted a virtual machine and when these actions occurred.
Other options: "No change is needed" . Incorrect. Azure Monitor collects metrics and logs from resources but does not provide a historical record of management actions performed by users.
"Azure Event Hubs" . Incorrect. Event Hubs is a data streaming platform and event ingestion service, not a management activity log.
"Azure Service Health" . Incorrect. Service Health provides notifications about Azure service incidents and planned maintenance, not individual user actions.
References:
Microsoft Learn: (https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log)
"The Azure Activity Log provides insight into operations that were performed on resources in your subscription. You can see who initiated the operation and when."-Microsoft Learn: (https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/overview)
"Azure Monitor collects monitoring telemetry, while the Activity Log tracks all control-plane operations, such as creating, modifying, or deleting resources." References: (https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit)

The Professional Direct (ProDirect) support plan provides access to Azure support engineers via phone and email, meeting the company's support policy requirement.-Other Azure support plans: Basic . Only provides access to billing and subscription support; does not include technical support via phone or email.-Developer . Provides technical support via email during business hours, but phone support is not included.-Standard . Provides email and phone support but may not
meet higher-tier service level requirements; ProDirect offers faster response and dedicated guidance.
References:
Microsoft Learn: (https://learn.microsoft.com/en-us/azure/azure-support-plans)
"The Professional Direct support plan provides 24x7 technical support, access to Azure support engineers by phone and email, and faster response times compared to the Standard plan." References: (https://azure.microsoft.com/en-gb/support/plans/)

A resource group is a logical container for Azure resources. When you create a resource group, you specify which location to create the resource group in. However, when you create a virtual machine and place it in the resource group, the virtual machine can still be in a different location (different datacenter). Therefore, creating multiple resource groups, even if they are in separate datacenters does not ensure that the services running on the virtual machines are available if a
single data center fails.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview#resource-groups

Azure App Service is a PaaS offering.
Azure Virtual Machines running Microsoft SQL Server are Infrastructure as a Service (IaaS).

They require management of the operating system and database software, which violates the "PaaS only" requirement.
WHY THIS IS INCORRECT
The solution mixes PaaS and IaaS:

Azure App Service = PaaS

Azure Virtual Machines with SQL Server = IaaS Because the company policy requires ONLY PaaS services, the presence of virtual machines makes the solution invalid.
CORRECT PaaS ALTERNATIVES
To satisfy the requirement, SQL Server on virtual machines should be replaced with a PaaS database service such as:

Azure SQL Database

Azure SQL Managed Instance
REFERENCES - MICROSOFT LEARN (OFFICIAL)

1. Azure App Service Overview (PaaS):
https://learn.microsoft.com/azure/app-service/overview
2. SQL Server on Azure Virtual Machines (IaaS):

https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview
3. Azure SQL Database (PaaS):
https://learn.microsoft.com/azure/azure-sql/database/sql-database-paas-overview
4. Azure SQL Managed Instance (PaaS):
https://learn.microsoft.com/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview
5. Cloud Service Models (IaaS vs PaaS vs SaaS):
https://azure.microsoft.com/resources/cloud-computing-dictionary/what-are-iaas-paas-and-saas/

FINAL ANSWER
No - The solution does NOT meet the requirement because Azure Virtual Machines run SQL Server as IaaS, not PaaS.

Azure policies can be used to define requirements for resource properties during deployment and for already existing resources. Azure Policy controls properties such as the types or locations of resources.

Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements.

In this question, we would create a Azure policy assigned to the resource group that denies the creation of virtual machines in the resource group.

You could place a read-only lock on the resource group. However, that would prevent the creation of any resources in the resource group, not virtual machines only. Therefore, an Azure Policy is a better solution.

References:
https://docs.microsoft.com/en-us/azure/governance/policy/overview

DevTest Labs creates labs consisting of pre-configured bases or Azure Resource Manager templates.
By using DevTest Labs, you can test the latest versions of your applications by doing the following tasks:
1. Quickly provision Windows and Linux environments by using reusable templates and artifacts.
2. Easily integrate your deployment pipeline with DevTest Labs to provision on-demand environments.
3. Scale up your load testing by provisioning multiple test agents and create pre-provisioned environments for training and demos.

References:
https://docs.microsoft.com/en-us/azure/lab-services/devtest-lab-overview