Azure Service Health provides a personalized view of the health of the Azure services and regions that a user consumes. It tracks three types of health events: service issues, planned maintenance, and health advisories. Administrators can configure alerts using Azure Monitor to be notified of these service health events via various channels like email or SMS. However, Azure Service Health is a monitoring and notification tool. It informs administrators about problems and planned work but does not provide any capability to directly intervene or prevent a service failure within Microsoft's underlying infrastructure.

Microsoft Learn. "What is Azure Service Health?". Microsoft Corporation. Accessed September 11, 2025. In the "Service Health events" section, the documentation states, "Service Health tracks three types of health events that may impact your resources: 1. Service issues... 2. Planned maintenance... 3. Health advisories..." This confirms that an administrator can view the health status of services.

Microsoft Learn. "Configure alerts for service health events". Microsoft Corporation. Accessed September 11, 2025. The overview section explicitly states, "This article shows you how to set up activity log alerts for service health notifications... You can configure alerts to notify you when service issues, planned maintenance, or other changes may affect the Azure services and regions you use." This directly supports the second statement.

Microsoft Learn. "Azure Service Health overview". Microsoft Corporation. Accessed September 11, 2025. The documentation describes Service Health as a service that provides "personalized guidance and support when issues with Azure services affect you." The focus is on awareness and response, not prevention of platform-level failures, which is Microsoft's responsibility. There is no mention of any feature allowing an administrator to prevent a service failure.

A. an Azure Active Directory (AzureAD) role: Manages user permissions to Azure resources (identity and access management), not network traffic filtering.

B. an Azure key vault: Securely stores and manages secrets, keys, and certificates; it does not control network access.

C. an Azure Active Directory group: Used to organize users and manage their access permissions collectively, not for network port control.

1. Microsoft Learn. "Network security groups." Azure Virtual Network documentation. Accessed October 26, 2023. In the "Overview" section, it states, "You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources."

2. Microsoft Learn. "How network security groups filter network traffic." Azure Virtual Network documentation. Accessed October 26, 2023. The document details how security rules are evaluated, specifying properties like "Source," "Source port ranges," "Destination," "Destination port ranges," and "Protocol" which are used to control traffic.

3. Microsoft Learn. "What is role-based access control (RBAC) for Azure resources?" Azure Active Directory documentation. Accessed October 26, 2023. This document clarifies that Azure roles are for managing who has access to Azure resources and what they can do with them, which is distinct from network traffic control.

4. Microsoft Learn. "About Azure Key Vault." Azure Key Vault documentation. Accessed October 26, 2023. The "Overview" section explains that Key Vault is a service for safeguarding cryptographic keys and other secrets, confirming it is not used for network filtering.

Azure Policy definitions with a Deny effect, such as the "Not Allowed Resource Type" policy, are evaluated and enforced during resource creation or update operations. They do not retroactively affect existing resources that were deployed before the policy was assigned.

In this scenario, VNET1 already exists within the resource group RG1. When the policy is applied, Azure's compliance scan will identify VNET1 as a "non-compliant" resource. However, the policy will not delete, move, or modify the operational state of this existing network. It will continue to function as it did before. The policy will only block future attempts to create new virtual networks within RG1 or to perform updates on VNET1 that trigger a policy evaluation.

Microsoft Azure Documentation | Understand Azure Policy effects:

Reference: In the "Deny" section, the documentation states, "Deny is used to prevent a resource request that doesn't match the defined standards...The creation or update of a resource is blocked." This clarifies that the effect applies to create/update actions, not to pre-existing resources. The "Evaluation timing" section further explains that evaluation happens before a resource create or update request is processed.

Microsoft Azure Documentation | Get compliance data of Azure resources:

Reference: The "How compliance works" section explains that for existing resources, "After a policy or initiative is assigned... Resources that are non-compliant with an assigned policy or initiative are marked as Non-compliant." This confirms that existing resources are marked for their compliance state rather than being altered or deleted.

D. A computer that runs Linux and has the Azure CLI tools installed: The Azure CLI is a separate command-line tool for managing Azure; it does not execute PowerShell scripts, which use a different syntax and command structure (cmdlets).

1. Microsoft Learn. (2024). Install the Azure Az PowerShell module. "The Az PowerShell module is a rollup module. Installing it downloads the generally available Az PowerShell modules and makes their cmdlets available for use. The Az PowerShell module works with PowerShell 7.2 and later on all platforms including Windows, macOS, and Linux. It's also compatible with Windows PowerShell 5.1." This supports options A and B.

2. Microsoft Learn. (2024). Overview of Azure Cloud Shell. "Cloud Shell is an interactive, authenticated, browser-accessible shell for managing Azure resources... Cloud Shell offers a browser-accessible, pre-configured shell experience... Cloud Shell comes with your favorite command-line tools and language support... PowerShell in Cloud Shell provides the Azure drive (Azure:)." This supports option C.

3. Microsoft Learn. (2024). What is the Azure CLI?. "The Azure command-line interface (Azure CLI) is a set of commands used to create and manage Azure resources... The Azure CLI commands are structured in groups and subgroups." This reference distinguishes the Azure CLI from Azure PowerShell, supporting the exclusion of option D.

Statement 1: An Azure subscription can have only one Account Administrator. This role is the billing owner of the subscription and has permissions to manage billing and change the Service Administrator. While multiple users can be granted the Owner role through Azure Role-Based Access Control (RBAC) to manage all resources within the subscription, the specific Account Administrator role is limited to a single user.

Statement 2: Azure subscriptions are associated with a Microsoft Entra ID (formerly Azure Active Directory) tenant. Management access can be granted to various identity types within that tenant, including work or school accounts (native Entra ID users) and guest users from other directories, not just Microsoft accounts (e.g., @outlook.com).

Statement 3: The Azure resource hierarchy is structured with subscriptions at a higher level than resource groups. A resource group exists within a single subscription and serves as a container for resources. A resource group cannot contain a subscription; rather, a subscription contains multiple resource groups.

Microsoft Learn. Add or change Azure subscription administrators. "By default, when you sign up for an Azure subscription, you are assigned the Account Administrator role... This role is the billing owner of the subscription. There's only one Account Administrator per Azure subscription."

Microsoft Learn. Azure fundamental concepts. "Resource groups are containers that hold related resources for an Azure solution. The resource group can include all the resources for the solution, or only those resources that you want to manage as a group. A resource group is created within a specific subscription."

Microsoft Learn. Accounts and subscriptions in Azure Active Directory. "Your Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices." This document details how work/school accounts from the associated directory are used for management.

Azure Active Directory Premium P2 guarantees at least 99.9 percent availability: Yes

• The official SLA for Azure Active Directory Premium P1 and P2 guarantees a 99.99% uptime. Since 99.99% is greater than 99.9%, the statement that it guarantees at least 99.9% availability is correct.

The Service Level Agreement (SLA) for Azure Active Directory Premium P2 is the same as the SLA for Azure Active Directory Free: No

• Azure Active Directory Premium P2 has a financially backed SLA of 99.99%. In contrast, the Azure Active Directory Free tier does not have a financially backed SLA. Therefore, their SLAs are not the same.

All paying Azure customers receive a credit if their monthly uptime percentage is below the guaranteed amount in the Service Level Agreement (SLA): Yes

• A core component of Azure's commitment to paying customers is the financially backed SLA. If a service's uptime drops below the guaranteed percentage for a given month, customers are eligible to claim and receive a service credit toward their bill. This is the fundamental promise of an Azure SLA for paid services.

Microsoft Azure Official Documentation. SLA for Azure Active Directory.

Introduction section: States, "For Azure Active Directory Premium P1 and P2, we guarantee at least 99.99% availability of the Azure Active Directory Service." This supports the "Yes" answer for the first statement.

Introduction section: Also notes, "For Azure Active Directory Free... we do not offer a financially backed service level agreement." This supports the "No" answer for the second statement.

General Terms, Claims section: Details the process for customers to claim service credits if the SLA is not met, confirming that paying customers are eligible for these credits. This supports the "Yes" answer for the third statement. This document is accessible via the Microsoft Azure legal information portal.

According to Microsoft's Service Level Agreements (SLAs), when an Azure service fails to meet its guaranteed uptime, the designated remedy is to provide the customer with service credits. These credits are a percentage of the applicable monthly service fees and are applied directly to the customer's Azure account to be used against future payments. Customers are required to submit a claim to Microsoft to receive these credits. This policy ensures compensation for downtime without issuing direct monetary refunds to a bank account.

Microsoft Azure Documentation, "Service Level Agreements (SLA) for Online Services".

Section: General Terms > Claims

Content: The documentation specifies that to receive compensation for an SLA breach, a customer must submit a claim. If the claim is validated, Microsoft provides a "Service Credit," which is defined as a percentage of the monthly service fees credited to the customer's account.

Microsoft Azure Legal, "Service Level Agreement for Microsoft Online Services".

Section: 1.5, Service Credits

Content: This legal document explicitly states, "Service Credits are your sole and exclusive remedy for any performance or availability issues for any Service under this SLA and the Agreement." It clarifies that credits are applied against future fees owed by the customer.

Microsoft Azure Documentation, "SLA summary for Azure services".

Content: This summary page links to individual SLAs for every Azure service (e.g., Virtual Machines, SQL Database). Each document contains a table that details the "Service Credit Percentage" a customer will receive based on the measured monthly uptime. This consistently shows the compensation model is based on credits, not refunds or other methods.

Resource Groups: A resource group is a logical container for managing Azure resources. Creating a resource group itself incurs no cost. You are only billed for the Azure resources (like virtual machines or storage accounts) that are deployed within the group.

Data Ingress (to Azure): Data transfer into Azure data centers, known as ingress, is free. This applies whether the data is coming from an on-premises network over the internet or through a private connection like a VPN.

Data Egress (from Azure): Data transfer out of Azure data centers, known as egress, is subject to charges. Copying data from Azure to an on-premises location, even over a VPN, is considered outbound data transfer and will incur costs based on the amount of data transferred.

Azure Resource Manager Overview. Microsoft Documentation, "Azure Resource Manager overview". In the section titled "Terminology," it clarifies that a resource group is a container and under the "Manage costs" section of related documentation, it is established that only the resources within the group have associated costs.

Azure Bandwidth Pricing. Microsoft Azure, "Bandwidth pricing details". The pricing table on this official page explicitly states that Inbound data transfers are "Free".

Azure VPN Gateway Pricing. Microsoft Azure, "VPN Gateway pricing". This page details the costs associated with VPN gateways. Under the "Data Transfer" section, it confirms that outbound data transfers from a virtual network to an on-premises site are charged at the standard outbound data transfer rates, corroborating the cost for data egress.

Azure Resource Manager enables the movement of resources, including virtual machines, between different subscriptions. This is a standard administrative operation. For the move to be successful, both the source and destination subscriptions must be within the same Azure Active Directory (Azure AD) tenant. The operating system of the virtual machine (e.g., Windows Server 2016, Linux) is not a limiting factor for the move. While related resources like network interfaces and disks must also be moved, the virtual machines do not all need to reside in the same source resource group to be moved.

Microsoft Learn (Official Azure Documentation). "Move resources to a new resource group or subscription." Microsoft Docs. Accessed September 11, 2025. In the Overview section, the document explicitly states, "This article shows you how to move Azure resources to either another Azure subscription or another resource group under the same subscription."

Microsoft Learn (Official Azure Documentation). "Move guidance for virtual machines." Microsoft Docs. Accessed September 11, 2025. This document provides specific checklists and procedures for moving virtual machines, confirming the capability. The Move support for virtual machines section details which associated resources are supported for a move operation, reinforcing that VMs are indeed movable assets.

A. Modify a DDoS protection plan.

A DDoS protection plan is designed to mitigate large-scale denial-of-service attacks; it does not define rules for allowing or denying specific types of traffic like HTTP.

C. Modify an Azure Traffic Manager profile.

Azure Traffic Manager is a DNS-based load balancer that directs traffic to endpoints. It does not control network access or open ports on the virtual machines themselves.

1. Microsoft Learn. "Network security groups." Azure Virtual Network documentation. Accessed May 20, 2024. In the "Introduction" section, it states, "You can use an Azure network security group to filter network traffic between Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources."

2. Microsoft Learn. "What is Azure Firewall?" Azure Firewall documentation. Accessed May 20, 2024. The "Features" section details its capabilities, including "Network traffic filtering rules," which states you can "Create allow or deny network filtering rules by source and destination IP address, port, and protocol."

3. Microsoft Learn. "What is Azure DDoS Protection?" Azure DDoS Protection documentation. Accessed May 20, 2024. The overview explains its purpose is to defend "against large-scale network layer (layer 3/4) attacks," not to configure port access rules.

4. Microsoft Learn. "What is Traffic Manager?" Azure Traffic Manager documentation. Accessed May 20, 2024. The "Overview" section clarifies, "Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic to your public facing applications across the global Azure regions." This confirms it operates at the DNS layer, not the network packet filtering layer.