For each of the following statements about Azure governance, select Yes if the statement is true. Otherwise, select No.
Select Yes or No for each statement.
- 1. Azure Policy can deny the creation of resources in Regions that your organization hasn't approved.
- 2. A ReadOnly resource lock stops authorized users from deleting the resource.
- 3. A resource group can contain another resource group.
Options: Yes, No.
Show answer and explanation
Correct matches
- Azure Policy can deny the creation of resources in Regions that your organization hasn't approved.: Yes
- A ReadOnly resource lock stops authorized users from deleting the resource.: Yes
- A resource group can contain another resource group.: No
Statement 1 is Yes: Azure Policy evaluates resources as they're created, and the built-in Allowed locations policy definition denies deployments to any Region that isn't on the approved list.
Statement 2 is Yes: a ReadOnly lock blocks both changes and deletion, even for users whose role would normally allow them. (A CanNotDelete lock blocks only deletion while still permitting changes.)
Statement 3 is No: resource groups cannot contain other resource groups. Each resource sits in exactly one resource group, and grouping happens a level up — across resource groups you use subscriptions and management groups.
Exam tip. Policy controls what can exist, RBAC controls who can act, and locks stop accidental change or deletion regardless of role.