Question
You review the following Azure CLI command and the relevant Bicep excerpt. (Non-relevant sections are omitted.)
```bicep
az deployment group create \
--resource-group rg-foundry-dev \
--template-file ./foundry-environment.bicep \
--parameters location=eastus projectName=proj-dev-01
// foundry-environment.bicep (excerpt)
targetScope = 'resourceGroup'
param location string
param projectName string
resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {
name: aiFoundryName
location: location
identity: {
type: 'SystemAssigned'
}
sku: {
name: 'S0'
}
kind: 'AIServices'
properties: {
allowProjectManagement: true
customSubDomainName: aiFoundryName
disableLocalAuth: true
}
}
```
You need to validate what the snippet will do before it is merged. For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Explanation
Statement 1 (Yes): az deployment group create starts a deployment at resource group scope, and its required --resource-group parameter names the group to deploy into. The template's targetScope is resourceGroup, and the command does not create the group, so rg-foundry-dev must already exist (docs create it first with az group create).
Statement 2 (No): The SystemAssigned identity belongs only to the Foundry resource (Microsoft.CognitiveServices/accounts). Each Foundry project is a subresource with its own project managed identity, which is granted roles separately, so the account identity is not inherited by projects.
Statement 3 (No): The target subscription is chosen by the CLI, not the template. Use the global --subscription parameter or az account set before running the command; the Bicep file needs no subscriptionId parameter.
