Governance & Key Management

Which Azure governance feature lets you audit or deny the creation of resources that do not meet organizational standards, such as requiring a specific tag or blocking public IP addresses?

• AA resource lock
• BAzure Policy✓
• CA network security group
• DMicrosoft Entra PIM

Answer: Azure Policy evaluates resources against rules and can audit non-compliant resources or use a deny effect to block creation that violates standards, such as missing tags or disallowed resource types. Resource locks only prevent deletion or modification of existing resources.

You want to deploy a related set of resources, role assignments and policy assignments as a single managed unit, so that deleting the unit also removes everything it created. What should you use?

• AA management lock
• BAzure Advisor
• CAzure deployment stacks✓
• DA single resource group

Answer: A deployment stack manages a collection of Azure resources — including role and policy assignments — as one unit with a defined lifecycle, so the whole set can be updated or torn down together. It is the supported successor to Azure Blueprints, which has retired. A management lock only blocks changes, Azure Advisor makes recommendations, and a resource group is a container that does not itself manage policy or role assignments as a unit.

You want to use your own key from Azure Key Vault to encrypt Azure Storage data at rest instead of a Microsoft-managed key. Which feature provides this?

• AClient-side encryption only
• BA user delegation SAS
• CAzure Disk Encryption
• DCustomer-managed keys for storage encryption✓

Answer: Customer-managed keys let you control the encryption key for storage service encryption by storing it in Azure Key Vault, including rotation and revocation. Azure Disk Encryption applies to VM disks, not storage account blob and file data.