Grounded in official sources. Carefully reviewed.

Azure Resource Manager (ARM) templates use declarative JSON syntax to define the desired state of your infrastructure. Key benefits include: repeatable deployments (the same template produces identical environments every time), consistency across dev/staging/prod, idempotency (redeploying the same template yields the same result without duplicating resources), and built-in orchestration (ARM resolves dependency ordering automatically). Templates do not replace subscriptions—you still need a subscription as the deployment target. A single template can deploy dozens of resources simultaneously, not just one. Cost optimization is Azure Advisor's domain, not ARM templates. Exam tip: ARM templates = declarative, repeatable, consistent, idempotent infrastructure-as-code. Also note Bicep is the recommended successor to JSON ARM templates. (Ref: learn.microsoft.com/azure/azure-resource-manager/templates/overview)

Azure Cloud Shell is a browser-based, authenticated terminal accessible from the Azure portal, shell.azure.com, or the Azure mobile app. It comes pre-installed with both Azure CLI (az commands) and Azure PowerShell (Az module), plus tools like kubectl, Terraform, git, and code editors. File persistence works through an Azure Files share (5 GB) mounted at your $HOME directory, ensuring scripts and configurations survive session restarts. Cloud Shell runs on a temporary Linux host that auto-authenticates with your Azure credentials. Sessions time out after 20 minutes of inactivity. You choose between Bash or PowerShell at launch. The statement is True because both CLIs are pre-installed and Azure Files provides cross-session persistence. (Ref: learn.microsoft.com/azure/cloud-shell/overview)

Azure resource locks prevent accidental deletion or modification of critical resources. Two lock types: CanNotDelete (Delete lock) — authorized users can read and modify the resource but cannot delete it. ReadOnly — authorized users can read the resource but cannot modify or delete it. Locks can be applied at subscription, resource group, or individual resource levels and inherit to child resources. Locks override RBAC permissions — even Owners cannot delete a CanNotDelete-locked resource without first removing the lock. Azure Policy enforces compliance rules but doesn't prevent deletion directly. RBAC controls access but can't prevent Owner-level deletions. Exam tip: Resource locks = prevent accidental deletion/modification. Two types: CanNotDelete and ReadOnly. Override RBAC.

The Azure resource hierarchy from highest to lowest scope is: Management groups → Subscriptions → Resource groups → Resources. Management groups sit at the top, organizing multiple subscriptions and applying governance at scale. Subscriptions are billing and access boundaries containing resource groups. Resource groups are logical containers grouping related resources for lifecycle management. Resources are the individual Azure services (VMs, databases, storage accounts). Policies and RBAC assignments at higher levels inherit down to lower levels. A resource can only belong to one resource group, a resource group to one subscription, and a subscription to one management group. Exam tip: Hierarchy top-down: Management groups > Subscriptions > Resource groups > Resources.