Examkin

Question

Difficulty: HardAzure Policy Definitions, Initiatives, and Assignments

An enterprise establishes the following Azure resource hierarchy:
* A management group named `Enterprise-MG`
* A subscription named `Sub-Finance-01` under `Enterprise-MG`
* Two resource groups under `Sub-Finance-01` named `RG-Secured` and `RG-General`

The following Azure Policy assignments are active:
* Policy Assignment 1: Assigned at `Enterprise-MG`. It uses a policy definition that denies the creation of virtual machines unless they use the `Standard_E2s_v3` SKU. The resource group `RG-Secured` is configured as an exclusion.
* Policy Assignment 2: Assigned at `Sub-Finance-01`. It uses a policy definition that denies the creation of resources unless they have a tag named `CostCenter`. The resource group `RG-General` is configured as an exclusion.

An administrator attempts to perform the following virtual machine deployments:
* Deployment 1: A `Standard_D2s_v3` virtual machine with the tag `CostCenter: 101` in `RG-General`
* Deployment 2: A `Standard_E2s_v3` virtual machine without the `CostCenter` tag in `RG-Secured`
* Deployment 3: A `Standard_D2s_v3` virtual machine without the `CostCenter` tag in `RG-General`
* Deployment 4: A `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured`

Which of the virtual machine deployments will succeed?

  1. The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured`Answer
  2. B
    The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 101` in `RG-General`
  3. C
    The deployment of the `Standard_E2s_v3` virtual machine without the `CostCenter` tag in `RG-Secured`
  4. D
    The deployment of the `Standard_D2s_v3` virtual machine without the `CostCenter` tag in `RG-General`

Answer

The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured` is the only deployment that will succeed.
The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured` succeeds because `RG-Secured` is explicitly excluded from the SKU restriction policy (Policy Assignment 1) assigned at the management group level, allowing the `Standard_D2s_v3` SKU. Furthermore, while the tag requirement policy (Policy Assignment 2) applies to `RG-Secured`, this deployment successfully provides the required `CostCenter` tag, satisfying both evaluation contexts.

Step-by-Step Solution

1
Evaluate the impact of Policy Assignment 1 (SKU restriction) on all deployments.
Policy Assignment 1 is assigned at `Enterprise-MG` (the root of this hierarchy) and applies to all child scopes except for the configured exclusion: `RG-Secured`. Therefore, virtual machines deployed in `RG-General` must use the `Standard_E2s_v3` SKU. Deployments 1 and 3 are blocked because they attempt to deploy a `Standard_D2s_v3` SKU in `RG-General`. Deployments 2 and 4 are in `RG-Secured` (excluded from this policy) and are not blocked by Policy Assignment 1.
Identify which deployments are prevented by the inherited SKU restriction policy.
2
Evaluate the impact of Policy Assignment 2 (Tag requirement) on the remaining deployments.
Policy Assignment 2 is assigned at `Sub-Finance-01` and applies to all resource groups under the subscription except for the configured exclusion: `RG-General`. Therefore, resources deployed in `RG-Secured` must include the `CostCenter` tag. Deployment 2 fails because it is in `RG-Secured` and does not include the tag. Deployment 4 includes the tag `CostCenter: 102` and complies with the policy.
Identify which deployments are prevented by the tag requirement policy.
3
Determine the final compliance outcome for all deployment attempts.
Only Deployment 4 matches all requirements: it is excluded from Policy Assignment 1 (allowing the `Standard_D2s_v3` SKU) and complies with Policy Assignment 2 (having the required `CostCenter` tag).
Synthesize evaluations of both policy assignments and exclusions to identify the successful deployment.

Key Concept

Evaluation of nested Azure Policies, scopes, and exclusions
Estimated Time:2m 0s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments