HOTSPOT - You have the Azure management groups shown in the following table: 

You add Azure subscriptions to the management groups as shown in the following table: 

You create the Azure policies shown in the following table: 

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area: 

Box 1: No - Virtual networks are not allowed at the root and is inherited. Deny overrides allowed. Box 2: Yes - Virtual Machines can be created on a Management Group provided the user has the required RBAC permissions. Box 3: Yes - Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-groups-and-subscriptions