Examkin

Question

Difficulty: EasyAzure Policy Definitions, Initiatives, and Assignments

An organization wants to implement governance across its Azure subscriptions. The administrator plans to use Azure Policy to restrict allowed virtual machine SKUs to 'Standard_D2s_v3' and audit resources that do not have a 'Department' tag. Which of the following statements regarding the implementation and behavior of these policies are correct? (Select TWO)

  1. Assigning a policy definition with the 'Deny' effect blocks the creation of virtual machines that use SKUs other than 'Standard_D2s_v3'.Answer
  2. Assigning a policy definition with the 'Audit' effect allows resources without the 'Department' tag to be deployed but marks them as non-compliant.Answer
  3. C
    Using the 'Disabled' effect on the SKU policy automatically remediates existing non-compliant virtual machines.
  4. D
    A single policy assignment using the 'Deny' effect automatically deletes any existing virtual machines that do not match the 'Standard_D2s_v3' SKU.

Answer

The correct statements are that assigning a policy definition with the 'Deny' effect blocks the creation of virtual machines using unapproved SKUs, and assigning a policy definition with the 'Audit' effect allows resources without the mandatory tag to be deployed but marks them as non-compliant.
The correct statements are that the 'Deny' effect blocks the creation of resources that violate policy definitions (such as virtual machines using unallowed SKUs), and the 'Audit' effect allows resources to deploy but marks them as non-compliant for visibility.

Step-by-Step Solution

1
Evaluate the 'Deny' effect behavior on new resource requests.
The 'Deny' effect blocks the creation or update of any resource that fails to meet the policy's criteria, preventing the deployment of unapproved VM SKUs.
To verify if the 'Deny' statement is correct.
2
Evaluate the 'Audit' effect behavior on non-compliant resources.
The 'Audit' effect does not block deployment but flags the resource as non-compliant in Azure Policy compliance reporting and logs an event.
To verify if the 'Audit' statement is correct.
3
Analyze the 'Disabled' effect and the retroactive action of 'Deny' on existing resources.
The 'Disabled' effect stops policy evaluation altogether. The 'Deny' effect does not delete existing non-compliant resources; it only marks them as non-compliant.
To identify why the remaining statements are incorrect.

Key Concept

Azure Policy effects control the compliance behavior when resources are evaluated against policy rules.
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments