Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

To enforce security standards, a company assigns an Azure Policy definition that blocks the deployment of public IP addresses to a management group named `MG-Corp`. A project team needs to deploy a public IP address inside a resource group named `RG-App1` within a subscription that is a child of `MG-Corp`. Which action should the administrator perform to allow this deployment while keeping the policy enforced for all other resources under the management group?

  1. A
    Assign a policy definition with the 'Audit' effect directly to the `RG-App1` resource group.
  2. B
    Assign a policy definition with the 'Disabled' effect directly to the `RG-App1` resource group.
  3. Add the `RG-App1` resource group to the excluded scopes list of the policy assignment at the `MG-Corp` level.Answer
  4. D
    Assign the Policy Contributor role to the project team's identity at the `RG-App1` scope.

Answer

Add the resource group to the excluded scopes list of the policy assignment at the management group level.
The correct action is to add the resource group to the excluded scopes list of the policy assignment at the management group level. Azure Policy assignments support exclusions, which allow specific resource groups, subscriptions, or resources to be bypassed during policy evaluation. This permits the project team to deploy public IP addresses within the resource group without affecting the enforcement of the policy on other resources in the management group.

Step-by-Step Solution

1
Analyze the inheritance of Azure Policy assignments.
The policy assigned at the parent management group scope (`MG-Corp`) is inherited by all child subscriptions and resource groups, including `RG-App1`.
Azure Policies are inherited downward through the resource hierarchy.
2
Determine the impact of lower-level policy assignments.
Assigning a different policy effect (such as Audit or Disabled) at a lower scope does not override the Deny effect inherited from the parent scope.
Azure Policy evaluates all applicable assignments, and a Deny effect from any scope will block the deployment.
3
Apply policy exclusion to bypass enforcement.
Configuring the exclusion list on the assignment at `MG-Corp` to include `RG-App1` prevents the policy from evaluating resources in that specific resource group.
Exclusions are the standard mechanism to exempt specific scopes from parent policy assignments while maintaining enforcement elsewhere.

Key Concept

Azure Policy scope inheritance and exclusions
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments