Chapter 1, Managing Azure Subscriptions and Resource Groups

1. 1—Yes, this does meet your goal. The access management setting from the Azure Active Directory Properties blade ensures that Azure AD users assigned to the global administrator role maintain full control over all subscription resources.
2. 4—You need to set a read-only lock on the resource group level. This will ensure that administrators and all other users can't make changes to all the different Azure resources that are created for your VM, such as changes to virtual networks, disks, and more.
3. 2—You should create taxonomic tags and assign them to the resource level; because Azure resources are spread over different resource groups, you can't apply them to the resource group level.