nerdexam
Microsoft

AZ-104 · Question #300

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. The status of VM1 is Running. You assign an Azure policy as shown in the exhibit. (Click the…

The correct answer is An administrator can move VNET1 to RG2 = No; The state of VM1 changed to deallocated = No; An administrator can modify the address space of VNET2 = No. The Azure policy being assigned is a 'Not allowed resource types' policy, which prevents the creation or modification of specified resource types (Classic VNets, VNets, and VMs) within the scope. Moving VNET1 to RG2 is not allowed because a move operation is treated as a…

Submitted by packet_pusher· Mar 4, 2026Manage Azure governance and compliance - specifically understanding how Azure Policy 'deny' effects impact resource operations including creation, modification, and movement of resources within a subscription or resource group scope.

Question

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. The status of VM1 is Running. You assign an Azure policy as shown in the exhibit. (Click the Exhibit tab.) You assign the policy by using the following parameters: Microsoft.ClassicNetwork/virtualNetworks Microsoft.Network/virtualNetworks Microsoft.Compute/virtualMachines For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-104 question #300 exhibit 1
AZ-104 question #300 exhibit 2
AZ-104 question #300 exhibit 3
AZ-104 question #300 exhibit 4

Answer Area

  • An administrator can move VNET1 to RG2No
  • The state of VM1 changed to deallocatedNo
  • An administrator can modify the address space of VNET2No

Explanation

The Azure policy being assigned is a 'Not allowed resource types' policy, which prevents the creation or modification of specified resource types (Classic VNets, VNets, and VMs) within the scope. Moving VNET1 to RG2 is not allowed because a move operation is treated as a create/delete action for the resource type Microsoft.Network/virtualNetworks, which is blocked by the policy. VM1's state does not change to deallocated because the policy only prevents new deployments or modifications - it does not retroactively affect already running resources. Modifying the address space of VNET2 is also blocked because changing the address space constitutes a write/update operation on a Microsoft.Network/virtualNetworks resource, which the policy denies.

Topics

#Azure Policy#Deny Effect#Resource Governance#Azure Networking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice