The proposed solution does not meet the goal. Azure resource groups are logical containers used for managing, monitoring, and controlling access to related resources. They do not provide any physical isolation or high-availability guarantees. Deploying virtual machines into multiple resource groups does not ensure they are placed in different physical data centers. To protect services against the failure of a single data center, the virtual machines must be deployed across multiple Availability Zones. Each Availability Zone is a physically separate data center within an Azure region, with independent power, cooling, and networking, thus providing the required resiliency.

A. Yes: This is incorrect because a resource group is a management and billing boundary, not a physical or fault-tolerant boundary. Resources in different resource groups can still reside in the same data center.

1. Microsoft Learn, "Regions and Availability Zones in Azure": Under the "Availability Zones" section, it states, "Availability Zones are physically separate datacenters within an Azure region... To ensure resiliency, there's a minimum of three separate zones in all enabled regions." This confirms that Availability Zones are the correct mechanism for data center-level redundancy.

2. Microsoft Learn, "Availability options for Azure Virtual Machines": This document explicitly states, "Availability Zones... protect your applications and data from datacenter failures." It clearly distinguishes this from other concepts and highlights its role in high availability.

3. Microsoft Learn, "What is Azure Resource Manager?": In the "Terminology" section, a resource group is defined as "A container that holds related resources for an Azure solution." This definition emphasizes its role as a logical container for management, with no mention of physical isolation or high availability capabilities.

Azure Resource Manager allows for the movement of resources, including virtual machines, between different Azure subscriptions. This is a standard administrative capability, often facilitated through the Azure portal or Azure Resource Mover. When a virtual machine is moved, all of its dependent resources (such as managed disks, network interfaces, and public IP addresses) must also be selected for the move operation. These dependent resources must reside in the same source resource group as the VM. The operating system (Option 4) is irrelevant to the move operation, and stating they "cannot be moved" (Option 1) is factually incorrect.

Microsoft Corporation. (n.d.). Move a Windows VM to another Azure subscription or resource group. Microsoft Learn. Retrieved November 3, 2025.

Section: "Move a VM to another subscription"

Quote: "You can move a VM and its associated resources to a different subscription by using the Azure portal."

Microsoft Corporation. (n.d.). Move resources to a new resource group or subscription. Microsoft Learn. Retrieved November 3, 2025.

Section: "Checklist before moving resources"

Quote: "The service must enable the ability to move resources. ... Virtual Machines and their associated resources (managed disks, network interfaces, public IPs) support the move operation."

Microsoft Corporation. (n.d.). Move resources to a new resource group or subscription. Microsoft Learn. Retrieved November 3, 2025.

Section: "Checklist before moving resources"

Note: This reference addresses the "same resource group" (Option 3) constraint. The rule is: "All resources in the source group that you want to move must be in the same source resource group. And, they must be moved to the same target resource group." This confirms that a specific move operation is tied to a single source resource group, but it does not prohibit the general capability of moving VMs from a subscription (which may be in different RGs) via separate operations. Therefore, Option 2 remains the most accurate statement of capability.

Azure AD Conditional Access policies are the appropriate tool for this requirement. They function as if-then statements, evaluating signals from users, devices, and locations to enforce organizational access rules. A Conditional Access policy can be configured to use "device compliance" as a condition for granting access. In this scenario, a policy would grant access to the Azure AD-integrated applications only if the user's device is marked as compliant by a management solution like Microsoft Intune, which can verify that the latest security patches are installed.

A. Azure Bastion: This service provides secure RDP and SSH connectivity to Azure virtual machines directly through the Azure portal, not for controlling access to applications based on device health.

C. Azure Policy: This service enforces rules and standards for Azure resources to ensure they remain compliant with corporate standards, but it does not manage user access to applications.

D. Azure Firewall: This is a network security service that protects Azure Virtual Network resources by filtering network traffic; it does not evaluate the compliance state of endpoint devices.

1. Microsoft Learn, "What is Conditional Access in Azure Active Directory?"

Section: Common signals

Content: "Device compliance - Users with devices marked as compliant with a specific policy can be differentiated from users with noncompliant devices." This document establishes that device compliance is a primary signal used by Conditional Access.

2. Microsoft Learn, "Conditional Access: Grant"

Section: Require device to be marked as compliant

Content: "This control requires that the device the user is signing in from is marked as compliant by a mobile device management (MDM) solution like Microsoft Intune... If a device isn't registered with an MDM solution, access is blocked." This directly confirms that requiring a compliant device is a grant control within Conditional Access.

3. Microsoft Learn, "Use compliance policies to set rules for devices you manage with Intune"

Section: How Intune device compliance policies work

Content: This document explains how Microsoft Intune evaluates device settings, such as OS version and security patch levels, to determine if a device is compliant. This compliance status is then reported to Azure AD for use in Conditional Access policies.

This question maps security controls to the standard "defense in depth" layered security model.

• Multifactor authentication (MFA) is a core component of the Identity and access layer. It ensures that a user is who they claim to be by requiring multiple forms of verification before granting access to resources.
• Software updates and patches are applied to virtual machines and operating systems to remediate vulnerabilities. This is a crucial security practice for hardening resources in the Compute layer.
• Surveillance cameras are a physical control used to monitor and protect the physical buildings and assets within a data center, placing them in the Physical security layer.

Microsoft Learn. (2024). Security - Defense in depth. Microsoft Docs.

Reference: In the "Defense in depth" article, Microsoft maps security controls to their respective layers. "Identity & access" is shown as the layer that includes controls like "Multi-factor authentication." The "Compute" layer is shown to protect virtual machines, which is accomplished via controls like patch management. The "Physical security" layer is described as the "first line of defense," protecting the physical hardware in the datacenter.

Microsoft Learn. (2024). Azure facilities, premises, and physical security. Microsoft Docs.

Reference: In the section "Facility security," the documentation states, "Video surveillance cameras are placed at strategic points throughout the data center..." This confirms that surveillance cameras are a key component of the Physical security layer.

National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations. Special Publication (SP) 800-53, Revision 5.

Reference: This standard, widely used in academia and government, defines security control families.

IA-2 (Identification and Authentication): Details the use of multi-factor authentication for identity management (Identity and access).

SI-2 (Flaw Remediation): Mandates the timely installation of "security-relevant software and firmware updates" (Compute).

PE-3 (Physical and Environmental Protection): Describes physical access controls, including the use of "video surveillance" (Physical security).

Statement 1 (Limited Services): False. An Azure free account includes free amounts of over 20 popular services for 12 months (for new customers) and over 65 always-free services, which is a broad selection beyond just Virtual Machines and Storage. This includes services like Azure App Service, Azure Functions, Azure SQL Database, and various AI/ML services (Source 1.1, 1.3).

Statement 2 (Expiration): True. The Azure free account has two components that expire: the $200 credit expires after 30 days, and the free services with limited quantity expire after 12 months (Source 1.4, 1.6). After expiration, the subscription is disabled unless upgraded to a Pay-as-you-go subscription.

Statement 3 (Multiple Accounts): False. The Azure free account offer is generally limited to one account per new customer (Source 1.1). Official documentation implies a restriction to one free account per person/entity to prevent misuse of the free credit and service limits (Source 2.2, 2.6).

Microsoft Azure Official Documentation. (2025). Create Your Azure Free Account Or Pay As You Go. (Source 1.1, 2.1).

Microsoft Azure Official Documentation. (2025). Explore Free Azure Services. (Source 1.3).

Microsoft Azure Official Documentation. (2025). Create free services with Azure free account - Microsoft Cost Management. (Source 1.4).

Microsoft Azure Official Documentation. (2025). Avoid charges with your Azure free account - Microsoft Cost Management. (Source 1.6).

Microsoft Azure Official Documentation. (2025). Azure for Students | Microsoft Azure (Referenced for the one-account-per-person principle across free offers). (Source 2.2).

Microsoft Azure Official Documentation. (2025). Troubleshoot issues when you sign up for a new account in the Azure portal - Microsoft Cost Management. (Referenced for sign-up process implying one account per unique identity/card). (Source 2.6).

Azure SQL Database is Microsoft's fully managed, relational Platform-as-a-Service (PaaS) database. This directly matches the description of a "managed relational cloud database service."

Azure Synapse Analytics integrates what was formerly Azure SQL Data Warehouse. Its dedicated SQL pools use a massively parallel processing (MPP) architecture specifically designed to run complex queries on petabyte-scale relational data warehouses.

Azure Data Lake Analytics (now being retired, but historically correct) was an on-demand analytics job service designed to run massively parallel data transformation and processing programs (using U-SQL) across petabytes of data in a data lake.

Azure HDInsight is the managed service for open-source distributed analytics frameworks, most notably Apache Hadoop and Apache Spark. The description "An open-source framework for the distributed..." clearly points to this service.

Azure SQL Database:

Source: Microsoft Azure Documentation, "What is Azure SQL Database?"

Reference: "Azure SQL Database is a fully managed platform as a service (PaaS) database engine... SQL Database is a relational data service..."

Azure Synapse Analytics (MPP):

Source: Microsoft Azure Documentation, "Dedicated SQL pool (formerly SQL DW) architecture in Azure Synapse Analytics"

Reference: "Dedicated SQL pool (formerly SQL DW) leverages a scale-out architecture to distribute computational processing of data across multiple nodes. The unit of scale is a Data Warehouse Unit (DWU), which represents an abstract bundle of compute resources... Dedicated SQL pool (formerly SQL DW) uses a massively parallel processing (MPP) architecture..."

Azure Data Lake Analytics:

Source: Microsoft Azure Documentation, "What is Azure Data Lake Analytics?"

Reference: "Azure Data Lake Analytics is an on-demand analytics job service that simplifies big data... you can write queries to transform your data... The analytics service can handle jobs of any scale instantly..." This service was known for its massively parallel execution of U-SQL jobs.

Azure HDInsight:

Source: Microsoft Azure Documentation, "What is Azure HDInsight?"

Reference: "Azure HDInsight is a managed, full-spectrum, open-source analytics service in the cloud for enterprises. With HDInsight, you can use open-source frameworks such as Apache Spark, Apache Hadoop, Apache Kafka, Apache HBase, and Storm in your Azure environment."

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its core function is to collect security data from various sources, including Azure Active Directory (Azure AD), and use intelligent analytics and threat intelligence to detect, investigate, and automatically respond to security threats. By using the built-in Azure AD data connector, Sentinel can ingest sign-in logs, audit logs, and provisioning logs for automated analysis, making it the correct tool for the specified task.

B. Azure Key Vault: This service securely stores and manages secrets, keys, and certificates. It does not collect or analyze security events from other services.

C. Azure Synapse Analytics: This is an enterprise analytics service for big data and data warehousing, not a specialized tool for real-time security event analysis and threat detection.

D. Azure AD Connect: This tool synchronizes on-premises identity directories with Azure AD. It does not analyze security events generated within Azure AD.

1. Microsoft Learn. (2023). "What is Microsoft Sentinel?". Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/overview. In the introduction, it states, "Microsoft Sentinel is a scalable, cloud-native solution that provides... Security information and event management (SIEM)... Security orchestration, automation, and response (SOAR)."

2. Microsoft Learn. (2023). "Connect Azure Active Directory (Azure AD) data to Microsoft Sentinel". Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory. This document explicitly details how to "stream logs from Azure Active Directory (Azure AD) into Microsoft Sentinel."

3. Microsoft Learn. (2023). "Describe the capabilities of Microsoft Sentinel". AZ-900: Microsoft Azure Fundamentals learning path. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-security-management-capabilities-azure/4-describe-capabilities-of-microsoft-sentinel. This official courseware states Sentinel's purpose is to "Collect data at cloud scale across all users, devices, applications, and infrastructure."

4. Microsoft Learn. (2023). "What is Azure Key Vault?". Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/key-vault/general/overview. This source confirms Key Vault's role is to safeguard cryptographic keys and other secrets.

The proposed solution is incorrect. A script written in PowerShell to manage Azure resources uses Azure PowerShell cmdlets, which are part of the Azure PowerShell (Az) module. To run such a script, the computer must have PowerShell and the Az module installed.

The solution incorrectly recommends installing the Azure CLI. The Azure CLI is a separate, distinct command-line tool with its own syntax (e.g., az group create) and cannot execute scripts written with PowerShell cmdlets (e.g., New-AzResourceGroup). While PowerShell can be installed on Linux, the specified tool (Azure CLI) is the wrong one for executing a PowerShell script.

A. Yes: This is incorrect because the solution specifies the wrong tool. The Azure CLI cannot execute a script written with Azure PowerShell cmdlets; the Azure PowerShell module is required.

1. Microsoft Learn. (2023). What is Azure PowerShell? "Azure PowerShell is a set of cmdlets for managing Azure resources directly from PowerShell... The Az PowerShell module is the recommended PowerShell module for interacting with Azure." Retrieved from https://learn.microsoft.com/en-us/powershell/azure/what-is-azure-powershell

2. Microsoft Learn. (2024). What is the Azure CLI? "The Azure command-line interface (Azure CLI) is a set of commands used to create and manage Azure resources." This documentation shows the distinct az command syntax, which is different from PowerShell's Verb-Noun cmdlet syntax. Retrieved from https://learn.microsoft.com/en-us/cli/azure/what-is-azure-cli

3. Microsoft Learn. (2024). Install the Azure Az PowerShell module. This document outlines the prerequisites for running Azure PowerShell scripts, stating, "The Azure Az PowerShell module is a rollup module. Installing it downloads the generally available Az PowerShell modules and makes their cmdlets available for use." It provides installation instructions for Windows, Linux, and macOS, none of which involve installing the Azure CLI. Retrieved from https://learn.microsoft.com/en-us/powershell/azure/install-az-ps

The Help + support blade is the correct selection because it contains the Azure Service Health feature. Service Health provides a personalized view of the health of the Azure services and regions you use. This includes active service incidents, upcoming planned maintenance events, and health advisories that could impact the availability of your resources within a specific subscription.

Microsoft Learn. (2024). Tutorial: View service health notifications by using the Azure portal. Microsoft Docs. Retrieved November 3, 2025.

Reference (Section "Get a link to your service health notification"): "Sign in to the portal, and then navigate to the Help + Support blade and select Service Health."

Microsoft Learn. (2024). What is Azure Service Health?. Microsoft Docs. Retrieved November 3, 2025.

Reference (Section "Service Health events"): "Service Health provides you with a personalized dashboard of the health of your Azure services and regions. It's the best place to look for service-impacting communications about availability... The Service Health dashboard in the Azure portal (available from Help + Support > Service Health) displays any active service issues, planned maintenance, and health advisories..."

Azure Cost Management is a comprehensive tool that provides visibility into costs and usage across various scopes.

1. It supports analysis at high-level containers like management groups, allowing for an aggregated view of costs across multiple subscriptions.
2. It also supports granular analysis at the resource group and individual resource level, which is a fundamental feature of the Cost Analysis tool.
3. The third statement is correct because "usage" in this context refers to billable usage quantities (e.g., "Compute Hours," "Data Transfer"), not real-time performance metrics. Azure Cost Management tracks and displays this consumption data, allowing you to analyze the quantity of services used over time. This data is available for at least the last 13 months.

Microsoft Learn. (2024). Overview of Cost Management. In: "Azure Cost Management documentation." This document states that Cost Management is "available from every subscription, resource group, and management group" and helps you "track usage, monitor expenses, identify cost anomalies, and forecast your expenditures."

Microsoft Learn. (2024). Understand and work with scopes. In: "Azure Cost Management documentation." This page explicitly lists management groups, subscriptions, and resource groups as the scopes at which you can apply permissions and view cost data.

Microsoft Learn. (2024). View and download Azure usage and charges. In: "Azure Cost Management documentation." This document details how to download "Usage Details" from the "Usage + charges" page within Cost Management + Billing. This report provides granular details on consumption.

Microsoft Learn. (2024). Understanding Azure virtual machine usage. In: "Azure Virtual Machines documentation." This document explains the specific billing meters for VMs, such as "Meter Name" (e.g., "Compute Hours"), "Unit" (e.g., "Hours"), and "Consumed" (the quantity used). This is the "usage" data that is fed into Azure Cost Management for analysis.

Microsoft Learn. (2024). Understand Cost Management data. In: "Azure Cost Management documentation." Section: "Cost and usage data updates and retention." This document confirms that "Summarized data in Cost Analysis is only available for the last 13 months," which satisfies the "last three months" requirement.