Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

An administrator manages an Azure environment with the following resource hierarchy:

* A management group named `Tenant-MG`.
* An Azure subscription named `Sub-Development` that is a child of `Tenant-MG`.
* A resource group named `RG-ProdMock` in `Sub-Development`.
* A resource group named `RG-Scratch` in `Sub-Development`.

The administrator applies the following policy assignments:

* Assignment 1: An Azure Policy definition that restricts allowed virtual machine SKUs to `Standard_D2s_v3` (using the `Deny` effect) is assigned to `Tenant-MG`. The assignment includes `RG-Scratch` in its Exclusions list.
* Assignment 2: An Azure Policy definition that requires the tag `Dept` (using the `Deny` effect) is assigned to `Sub-Development`. No exclusions are configured.

Which of the following virtual machine deployments will be successfully created? (Select TWO)

  1. A Standard_D2s_v3 virtual machine with the tag Dept=Finance deployed in RG-ProdMockAnswer
  2. A Standard_E4s_v3 virtual machine with the tag Dept=Engineering deployed in RG-ScratchAnswer
  3. C
    A Standard_E4s_v3 virtual machine with the tag Dept=Sales deployed in RG-ProdMock
  4. D
    A Standard_D2s_v3 virtual machine without the Dept tag deployed in RG-Scratch

Answer

The deployments that will succeed are a Standard_D2s_v3 virtual machine with the tag Dept=Finance deployed in RG-ProdMock, and a Standard_E4s_v3 virtual machine with the tag Dept=Engineering deployed in RG-Scratch.
The deployment of a Standard_D2s_v3 VM with the Dept tag in RG-ProdMock succeeds because it conforms to both assignments. The deployment of a Standard_E4s_v3 VM with the Dept tag in RG-Scratch succeeds because RG-Scratch is excluded from the SKU-restricting policy assignment, and it satisfies the tag requirement.

Step-by-Step Solution

1
Evaluate the virtual machine SKU policy assignment.
The SKU restriction is assigned at the Tenant-MG scope, enforcing Standard_D2s_v3. Since RG-Scratch is excluded, only resources inside RG-Scratch can use other SKUs (like Standard_E4s_v3), while resources in RG-ProdMock must use Standard_D2s_v3.
Policy assignments are inherited down the resource hierarchy unless explicit exclusions are defined at the assignment scope.
2
Evaluate the tag policy assignment.
The Dept tag policy is assigned at the Sub-Development scope with no exclusions. All resources in both RG-ProdMock and RG-Scratch must have the Dept tag.
Exclusions from one policy assignment do not apply to other assignments.
3
Combine the evaluations to determine the status of each deployment choice.
The Standard_D2s_v3 virtual machine with Dept=Finance in RG-ProdMock satisfies both policies. The Standard_E4s_v3 virtual machine with Dept=Engineering in RG-Scratch satisfies both policies because the SKU policy is bypassed via exclusion and the tag is present. The other options fail due to violating one of the policies.
For a deployment to succeed, it must comply with all applicable policies assigned at its level or inherited from parent scopes.

Key Concept

Azure Policy assignments are inherited down the resource hierarchy, and exclusions only apply to the specific assignment on which they are configured.
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments