CSLB General Building (B) — All Questions

What is the primary purpose of Microsoft Cost Management in Azure?

• a.To deploy virtual machines
• b.To host web applications
• c.To monitor, analyze, and optimize spending across Azure resources✓
• d.To store unstructured data

Microsoft Cost Management provides tools to track, analyze, and control Azure spending. It offers cost analysis, budgets, and recommendations to optimize usage. This helps organizations stay within budget and identify savings opportunities.

What is the main use of tags applied to Azure resources?

• a.To physically label servers in the datacenter
• b.To encrypt the resource's data
• c.To increase the resource's performance
• d.To attach metadata (key-value pairs) for organizing, tracking costs, and managing resources✓

Tags are key-value pairs you assign to resources to add descriptive metadata. They enable grouping and filtering for cost reporting, ownership, and environment tracking. For example, tagging by department lets you break down spending accurately.

What does Azure Policy help an organization enforce?

• a.Rules and standards that keep resources compliant, such as allowed regions or required tags✓
• b.The physical location of datacenters
• c.The pricing of virtual machines
• d.The color scheme of the portal

Azure Policy lets you define and enforce organizational rules for resources at scale. Policies can require certain configurations, restrict resource types or regions, and flag non-compliant resources. This drives consistent governance and regulatory compliance.

What does role-based access control (RBAC) in Azure allow you to do?

• a.Encrypt all network traffic automatically
• b.Grant users only the specific permissions they need, scoped to particular resources✓
• c.Deploy virtual machines faster
• d.Reduce storage costs

Role-based access control (RBAC) assigns permissions through roles at a chosen scope such as a subscription, resource group, or resource. This follows the principle of least privilege, granting only the access users need. It centralizes and simplifies permission management.

What is the purpose of a resource lock in Azure?

• a.To encrypt data at rest
• b.To speed up resource deployment
• c.To prevent accidental deletion or modification of critical resources✓
• d.To lower the monthly bill

Resource locks protect important resources from accidental changes or deletion. A 'CanNotDelete' lock allows edits but blocks deletion, while a 'ReadOnly' lock blocks both changes and deletion. Locks apply regardless of a user's RBAC permissions.

Which Azure service collects telemetry such as metrics and logs to help you observe the health and performance of resources?

• a.Azure Blob Storage
• b.Azure Key Vault
• c.Azure DNS
• d.Azure Monitor✓

Azure Monitor gathers metrics, logs, and other telemetry from Azure resources and applications. It enables visualization, alerting, and analysis of performance and availability. This visibility is essential for detecting and diagnosing issues.

Which two lock types are available for Azure resource locks?

• a.CanNotDelete and ReadOnly✓
• b.Encrypt and Decrypt
• c.Public and Private
• d.Hot and Cool

Azure supports two lock types: CanNotDelete, which permits reads and updates but prevents deletion, and ReadOnly, which prevents any modification or deletion. These locks override RBAC permissions to safeguard resources. They are applied at the resource, group, or subscription scope.

What is the benefit of setting a budget in Microsoft Cost Management?

• a.It automatically doubles your resource capacity
• b.It tracks spending against a defined threshold and can trigger alerts when limits are approached✓
• c.It encrypts all your resources
• d.It provisions new subscriptions

A budget in Cost Management sets a spending threshold for a scope such as a subscription or resource group. When actual or forecasted costs approach the limit, alerts notify stakeholders. This proactive control helps prevent unexpected overspending.

Which tool provides personalized recommendations to improve the cost, security, reliability, performance, and operational excellence of your Azure resources?

• a.Azure Blob Storage
• b.Azure DNS
• c.Azure Advisor✓
• d.Azure Functions

Azure Advisor analyzes your resource configuration and usage, then provides tailored recommendations. Its guidance spans cost optimization, security, reliability, performance, and operational excellence. Following its suggestions improves your environment's efficiency and posture.

How can Azure Policy remediate a resource that is created without a required tag?

• a.It deletes the entire subscription
• b.It encrypts the resource
• c.It increases the resource's size
• d.It can be configured to deny the deployment or automatically add the missing tag✓

Azure Policy supports effects such as 'deny,' which blocks non-compliant deployments, and 'modify' or 'append,' which can add a required tag. This ensures resources meet standards either by prevention or automatic correction. Remediation tasks can also fix existing non-compliant resources.

In RBAC, what does the 'scope' of a role assignment determine?

• a.The set of resources to which the granted permissions apply✓
• b.The color of the resource icon
• c.The physical datacenter used
• d.The billing currency

The scope defines where a role's permissions take effect, such as a management group, subscription, resource group, or individual resource. Assigning at a broad scope grants access to everything beneath it. Choosing the narrowest appropriate scope supports least-privilege access.

What is a primary advantage of using management groups for governance?

• a.They store application secrets
• b.Policies and access assigned at a management group are inherited by all subscriptions within it✓
• c.They provide serverless compute
• d.They cache web content

Management groups let you apply governance such as Azure Policy and RBAC across many subscriptions at once. Assignments made at the management group level are inherited by all contained subscriptions and resources. This ensures consistent policy across a large organization.

Which feature helps you understand where your Azure money is going by breaking down spending by resource, tag, or service?

• a.Azure DNS
• b.Availability zones
• c.Cost analysis in Microsoft Cost Management✓
• d.Network peering

Cost analysis provides interactive breakdowns of your Azure spending across dimensions such as service, resource group, and tag. It helps identify cost drivers and trends over time. These insights support budgeting and optimization decisions.

What is the purpose of an Azure alert in Azure Monitor?

• a.To encrypt stored data
• b.To create new subscriptions
• c.To provision virtual networks
• d.To notify you or trigger an action when a monitored condition or threshold is met✓

Alerts in Azure Monitor watch metrics or logs and fire when defined conditions are met, such as high CPU usage. They can send notifications or trigger automated responses through action groups. This enables proactive operations and faster incident response.

Which Azure governance tool would you use to package policies, role assignments, and resource templates as a repeatable, enforceable set?

• a.Azure Blueprints✓
• b.Azure Blob Storage
• c.Azure Cache for Redis
• d.Azure DNS

Azure Blueprints lets you define a repeatable set of governance artifacts including policies, RBAC role assignments, and resource templates. You can deploy these consistently to new environments to ensure they start compliant. This standardizes how subscriptions are set up.

What does the principle of 'least privilege' mean when assigning RBAC roles?

• a.Every user gets full administrator rights
• b.Users are given only the minimum permissions necessary to perform their tasks✓
• c.No user is ever given any access
• d.Permissions are assigned randomly

Least privilege means granting users just enough access to do their jobs and no more. This reduces the risk and potential impact of compromised or misused accounts. RBAC supports this by allowing precise, scoped role assignments.

Which built-in RBAC role grants full access to manage all resources, including assigning roles to others?

• a.Reader
• b.Contributor
• c.Owner✓
• d.Billing Reader

The Owner role provides full access to manage resources and, unlike Contributor, can also grant access to others by assigning roles. Contributor can manage resources but cannot assign roles, and Reader can only view. Choosing the right role enforces least privilege.

Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

• a.Owner
• b.Reader
• c.Guest
• d.Contributor✓

The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

Which built-in RBAC role provides view-only access with no ability to make changes?

• a.Reader✓
• b.Owner
• c.Contributor
• d.User Access Administrator

The Reader role grants the ability to view resources but not to create, modify, or delete them. It is ideal for auditors or stakeholders who need visibility without change rights. It represents the least-privileged of the common built-in roles.

What is the main benefit of applying consistent tagging across your Azure resources?

• a.It automatically encrypts the resources
• b.It enables accurate cost allocation and reporting by department, project, or environment✓
• c.It increases network bandwidth
• d.It reduces the number of regions used

Consistent tags let you slice cost and usage data by meaningful categories such as department or project. This supports chargeback, showback, and accountability across teams. Tagging standards can even be enforced through Azure Policy.

Which service helps you improve your organization's security posture by providing a security score and recommendations?

• a.Azure Blob Storage
• b.Azure DNS
• c.Microsoft Defender for Cloud✓
• d.Azure Cache for Redis

Microsoft Defender for Cloud assesses your resources' security and provides a secure score along with actionable recommendations. It helps identify misconfigurations and threats across your environment. Acting on its guidance strengthens overall security.

What does an action group in Azure Monitor define?

• a.The physical location of a datacenter
• b.The redundancy level of storage
• c.The size of a virtual machine
• d.The set of notifications and automated actions to run when an alert fires✓

An action group is a reusable collection of notification targets and actions, such as emails, SMS, or webhooks. When an alert triggers, its associated action group carries out these responses. This lets you standardize how incidents are communicated and handled.

Which capability of Azure Policy shows how many of your resources currently meet defined standards?

• a.Compliance reporting✓
• b.Blob replication
• c.DNS resolution
• d.Autoscaling

Azure Policy provides compliance reporting that evaluates resources against assigned policies. It shows which resources are compliant or non-compliant, giving a clear governance overview. This helps organizations track and prove adherence to standards.

What is the purpose of the Azure Pricing Calculator?

• a.To deploy resources into production
• b.To estimate the cost of Azure services before deploying them✓
• c.To encrypt stored data
• d.To monitor live performance

The Azure Pricing Calculator lets you model and estimate the cost of Azure services based on your expected configuration and usage. It supports planning and budgeting before any resources are provisioned. This helps avoid surprises on the bill.

What does the Total Cost of Ownership (TCO) Calculator help organizations do?

• a.Deploy virtual machines automatically
• b.Encrypt data in transit
• c.Compare the cost of running workloads on-premises versus in Azure✓
• d.Configure DNS records

The TCO Calculator estimates the cost savings of migrating on-premises workloads to Azure. It compares current infrastructure expenses with projected Azure costs, including hardware, power, and staffing. This supports the business case for cloud migration.

Which of the following is a valid strategy to reduce Azure virtual machine costs for predictable, long-running workloads?

• a.Deleting all backups
• b.Disabling monitoring entirely
• c.Running only during business hours without automation
• d.Purchasing reserved instances for a one- or three-year term✓

Reserved instances let you commit to a VM for one or three years in exchange for a significant discount over pay-as-you-go pricing. They suit steady, predictable workloads that run continuously. This is a common cost-optimization technique in Azure.

What is Azure Spot pricing best suited for?

• a.Interruptible workloads that can tolerate being evicted when Azure needs the capacity back✓
• b.Mission-critical databases that must never stop
• c.Workloads requiring guaranteed uptime
• d.Long-term reserved capacity

Azure Spot pricing offers unused capacity at deep discounts, but Azure can reclaim (evict) it when demand rises. It is ideal for fault-tolerant, interruptible workloads like batch processing or testing. It should not be used for services that must run without interruption.

How does inheritance work when an Azure Policy is assigned at the subscription level?

• a.Only newly created resources in one region comply
• b.All resource groups and resources within that subscription inherit and must comply with the policy✓
• c.The policy applies to other subscriptions too
• d.Nothing inherits the policy

When a policy is assigned at the subscription scope, it applies to all resource groups and resources beneath it through inheritance. Lower scopes automatically fall under the higher-level assignment. This makes it efficient to enforce standards broadly.

What is the benefit of using Azure Monitor Log Analytics workspaces?

• a.They provision virtual machines
• b.They cache web content at the edge
• c.They collect and store log data so you can run queries and analyze it across resources✓
• d.They host relational databases

A Log Analytics workspace is a central repository where Azure Monitor stores log and performance data. You can query this data with a powerful language to investigate issues and build insights. Consolidating logs supports troubleshooting and reporting across your environment.

Which governance approach helps ensure resources are deployed only in approved geographic regions?

• a.Applying a ReadOnly resource lock
• b.Assigning the Reader RBAC role
• c.Enabling zone-redundant storage
• d.Using an Azure Policy that restricts allowed locations✓

A common Azure Policy restricts the regions in which resources may be deployed to an approved list. This supports data-residency and compliance requirements by preventing deployments elsewhere. Non-compliant deployment attempts are blocked or flagged.

What distinguishes RBAC from Azure Policy in governance?

• a.RBAC controls who can do what to resources, while Azure Policy controls what configurations resources may have✓
• b.They are identical and interchangeable
• c.RBAC encrypts data and Policy provisions VMs
• d.Azure Policy assigns user passwords

RBAC governs identity and access, determining which users or identities can perform which actions on resources. Azure Policy governs resource properties and configurations, enforcing standards regardless of who deploys. Used together, they provide comprehensive governance.

Which feature lets you group related alerts and manage the notification recipients and automated responses centrally?

• a.Availability zones
• b.Action groups✓
• c.Blob tiers
• d.Peering connections

Action groups centralize the recipients and actions that respond to alerts, such as notifying an on-call team or invoking automation. Reusing an action group across many alerts keeps notification logic consistent. This simplifies operations and incident handling.

What is a key reason to enable diagnostic settings on Azure resources?

• a.To physically relocate the datacenter
• b.To reduce the resource's memory
• c.To route resource logs and metrics to destinations like Log Analytics for analysis and retention✓
• d.To change the billing currency

Diagnostic settings specify where a resource's platform logs and metrics are sent, such as a Log Analytics workspace, storage account, or event hub. This enables long-term retention, analysis, and integration with monitoring tools. It is foundational to observability and auditing.

Which statement best describes how tags and Azure Policy can work together?

• a.Tags disable all Azure Policies
• b.Azure Policy deletes all tags on creation
• c.Tags replace the need for RBAC
• d.Azure Policy can require, add, or enforce specific tags on resources automatically✓

Azure Policy can mandate that resources carry certain tags, append missing tags, or inherit tags from their resource group. This automates and enforces tagging standards across the environment. Consistent tags then power accurate cost tracking and organization.