Examkin

Question

Difficulty: HardAzure Policy Definitions, Initiatives, and Assignments

An administrator configures the following Azure resource hierarchy:
* A management group named `Contoso-Org-MG`
* A subscription named `Sub-Procurement-01` under `Contoso-Org-MG`
* Two resource groups within `Sub-Procurement-01` named `rg-operational-prod` and `rg-testing-dev`

The administrator configures two Azure Policy assignments:
1. Assignment 1: Assigns a policy definition that denies the deployment of virtual machines unless they use the `Standard_D8s_v5` or `Standard_D16s_v5` SKU. This policy is assigned at the `Contoso-Org-MG` management group scope, with an exclusion configured for the `rg-testing-dev` resource group.
2. Assignment 2: Assigns a policy definition that denies the deployment of resources unless they contain a tag named `DeptCode`. This policy is assigned at the `Sub-Procurement-01` subscription scope, with no exclusions configured.

A developer attempts to perform the following actions:
* Action 1: Create a virtual machine using the `Standard_D8s_v5` SKU and a tag named `DeptCode` in the `rg-operational-prod` resource group.
* Action 2: Create a virtual machine using the `Standard_B2s` SKU and a tag named `DeptCode` in the `rg-testing-dev` resource group.
* Action 3: Create a virtual machine using the `Standard_D16s_v5` SKU and no tags in the `rg-operational-prod` resource group.
* Action 4: Create a virtual machine using the `Standard_B2s` SKU and no tags in the `rg-testing-dev` resource group.

Which of the actions will succeed? (Select two)

  1. Action 1Answer
  2. Action 2Answer
  3. C
    Action 3
  4. D
    Action 4

Answer

The actions that will succeed are Action 1 and Action 2.
The actions that succeed are Action 1 and Action 2. In Action 1, the virtual machine meets both policy conditions (the SKU is permitted, and the DeptCode tag is present). In Action 2, the target resource group (rg-testing-dev) is excluded from the SKU restriction (Assignment 1), meaning the Standard_B2s SKU is allowed, and the deployment satisfies the tagging requirement (Assignment 2) by including the DeptCode tag.

Step-by-Step Solution

1
Evaluate Action 1 against the active policy assignments for rg-operational-prod.
The target resource group rg-operational-prod inherits both Assignment 1 and Assignment 2. The virtual machine uses the allowed Standard_D8s_v5 SKU (satisfying Assignment 1) and contains the required DeptCode tag (satisfying Assignment 2). Action 1 succeeds.
To verify if the deployment succeeds, the resource must satisfy all policies applied to its scope and parent scopes.
2
Evaluate Action 2 against the active policy assignments for rg-testing-dev.
The target resource group rg-testing-dev is excluded from Assignment 1, meaning the SKU restriction does not apply. It still inherits Assignment 2, which requires the DeptCode tag. Since the tag is present, Action 2 succeeds.
Policy exclusions prevent the policy rules of a specific assignment from being evaluated against resources at that excluded scope.
3
Evaluate Action 3 against the active policy assignments for rg-operational-prod.
Although the SKU Standard_D16s_v5 is allowed under Assignment 1, the deployment fails because the virtual machine lacks the required DeptCode tag mandated by Assignment 2.
Azure Policies are cumulative; failing any single policy with a Deny effect blocks the entire resource deployment.
4
Evaluate Action 4 against the active policy assignments for rg-testing-dev.
Even though Assignment 1's SKU restriction is bypassed due to the exclusion, Assignment 2 still applies because there are no exclusions configured for Assignment 2. Since the resource lacks the DeptCode tag, Action 4 fails.
An exclusion on one policy assignment does not exempt the resource from other assignments targeting the same scope.

Key Concept

Azure Policy assignment inheritance, cumulative evaluation of Deny policies, and scope-specific exclusions.
Estimated Time:2m 30s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments