Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

Your organization uses the following Azure resource hierarchy:
* A root management group named Tenant-Root-MG
* A management group named Platform-MG under Tenant-Root-MG
* A management group named Workloads-MG under Tenant-Root-MG
* An Azure subscription named Sub-SharedServices under Platform-MG
* An Azure subscription named Sub-Production under Workloads-MG
* Two resource groups named RG-Network and RG-Security under Sub-SharedServices

You assign an Azure Policy definition named "Require CostCenter tag on resources" to the Platform-MG scope. The policy uses the Deny effect. You add the RG-Security resource group to the exclusions (notScopes) list of the policy assignment.

An administrator attempts to perform the following operations:
* Operation 1: Create a virtual network in RG-Network without the CostCenter tag.
* Operation 2: Create a key vault in RG-Security without the CostCenter tag.
* Operation 3: Create a virtual machine in Sub-Production without the CostCenter tag.

Which operations will complete successfully?

  1. A
    Only Operation 2
  2. Only Operation 2 and Operation 3Answer
  3. C
    Only Operation 1 and Operation 2
  4. D
    Operation 1, Operation 2, and Operation 3

Answer

Only Operation 2 and Operation 3 will complete successfully.
The operations that complete successfully are Operation 2 and Operation 3. Operation 2 is successful because RG-Security is excluded from the assignment's scope via the notScopes property. Operation 3 is successful because Sub-Production is part of the Workloads-MG hierarchy, which is completely separate from the Platform-MG scope where the policy is assigned.

Step-by-Step Solution

1
Determine the scope of the policy assignment.
The policy is assigned at Platform-MG. This scope covers the child subscription Sub-SharedServices and both of its resource groups (RG-Network and RG-Security). It does not cover Workloads-MG or its child subscription Sub-Production.
Azure Policy assignments apply to the assigned scope and inherit down the hierarchy unless excluded.
2
Identify any exclusions (notScopes) configured for the assignment.
The resource group RG-Security is explicitly excluded from the Platform-MG policy assignment scope.
Exclusions prevent the policy from being evaluated or enforced on resources within the excluded scope.
3
Evaluate compliance and enforcement for each operation.
Operation 1 (RG-Network) is within the policy scope and not excluded; thus, the Deny policy blocks it. Operation 2 (RG-Security) is within the excluded scope, so the policy is not applied and the operation succeeds. Operation 3 (Sub-Production) is outside the Platform-MG scope, so the policy is not applied and the operation succeeds.
To determine which resource creation tasks are blocked by a Deny policy based on their location.

Key Concept

Azure Policy assignment scopes, inheritance, and exclusions
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments