tested out and found that indeed after policy, the VM goes into a deallocated state.

Shouldn't it be Yes, No, No? I've tried this in my Azure account and I was surprised that I was able to move Vnet1 from RG1 to RG2 despite RG2 having the policy enforced.

Test in Lab, not able to move Vnet1 to RG2, showing error : Moving resources failed There was an error moving resources. Resource move policy validation failed. Please see details. Diagnostic information: subscription id 'XXXXXXXXXXXXXXXXX', request correlation id 'XXXXXXXXXXXXXXXXXXXXXXXX'. (Code: ResourceMovePolicyValidationFailed) Resource 'Vnet1' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types","id":"/subscriptions/XXXXXXX/resourceGroups/RG2/providers/Microsoft.Authorization/policyAssignments/XXXXXXXX"},"policyDefinition":{"name":"Not allowed resource types","id":"/providers/Microsoft.Authorization/policyDefinitions/XXXXXXX"}}]'. (Code: RequestDisallowedByPolicy, Target: Vnet1) Related events

y n n is correct

answers are Y N N we can move resources when the policy is applied you can infact deallocate the VM or restart it but the VM won't be deallocated when the policy is applied , wording of the question isn't good when try to change the address space you will get error due to the policy tried it in the lab

NO NO NO

Yes Admin can move VNET1, the state of Vm1 no change, the admin can not modify the addrees space

all the options are no checked in lab environment

guess all possible combination of answers is here.

Exam Question 12/23/2020

just tested this in my lab and the answers are Y N N

just tested this in my lab and confirm that the answers are Y, N, N Y - i was able to move VNET1 to RG2 N - the VMs status did not change to deallocated N - with the policy in place i was not able to modify the VNET2 address space. as a further test i removed the policy waited a few minutes and was then able to make changes to VNET2 address space.

I just did a lab. It is Yes, No, Yes. The mirror of what is shown :)

Yes, No and No

NO, NO NO.

which means "Azure pass / RG2"?

I was wrong in my last post: I did not wait/check that the policycompliancescan had actually been run. RG2 -> Policies Ensure status is not "NOT STARTED" Would guess this is the reason for all the confusing in this thread. After the Policy was actually started, I got the following answer YES - I could move the VNET (does not make sense in my oppinion, but thats how it is) NO - The status of the VM did not change NO - I could not change Address-space of the existing VNET