Examkin

Question

Difficulty: Very hardManagement Groups Hierarchies

Zenith Retail Group uses the following Azure Management Group hierarchy:

* Tenant Root Group (Policy assigned: Allowed locations restricted to `East US` with Deny effect)
* Retail-Operations (Management Group) (Policy assigned: Allowed locations restricted to `East US 2` with Deny effect; Role assignment: User1 is assigned the Contributor role)
* Online-Store (Management Group)
* Sub-Online-Prod (Subscription) (Role assignment: User1 is assigned the Reader role)
* RG-Web-Prod (Resource Group) (Resource Lock: CanNotDelete lock applied)

User1 attempts to create a new virtual machine in the resource group `RG-Web-Prod` in the `East US 2` region.

Which of the following describes the outcome of the deployment attempt?

  1. The deployment is denied because it violates the Allowed locations policy assigned at the Tenant Root Group level.Answer
  2. B
    The deployment is denied because the Reader role assignment at the subscription level overrides the Contributor role assignment inherited from the Retail-Operations management group.
  3. C
    The deployment is denied because the CanNotDelete lock on the resource group prevents any changes, including the creation of new resources.
  4. D
    The deployment succeeds in East US 2 because the policy assigned at the Retail-Operations management group level overrides the policy assigned at the Tenant Root Group level.

Answer

The deployment is denied because it violates the Allowed locations policy assigned at the Tenant Root Group level.
The correct option is correct because Azure Policy evaluation is cumulative across all hierarchical scopes. A resource deployment must comply with the policy assignments at the resource scope, resource group scope, subscription scope, and all parent management group scopes. The virtual machine deployment in East US 2 satisfies the policy at the Retail-Operations level, but violates the Tenant Root Group policy, which only permits East US.

Step-by-Step Solution

1
Evaluate the effective RBAC permissions for User1 on the target resource group.
User1 has effective Contributor permissions.
Azure RBAC role assignments are additive. The inherited Contributor assignment from the Retail-Operations management group level is not canceled or overridden by the more specific Reader assignment at the subscription level.
2
Evaluate the impact of the resource lock on the resource group.
The CanNotDelete lock does not block virtual machine creation.
A CanNotDelete lock prevents authorized users from deleting a resource, but allows creating, reading, or modifying resources.
3
Evaluate the cumulative effect of the assigned Azure Policies.
The deployment is blocked by the Tenant Root Group policy.
Azure Policy evaluations are cumulative. For a resource to be successfully deployed, it must satisfy the policy rules at all scopes in its path. Since the Tenant Root Group restricts deployments to East US and the Retail-Operations group restricts them to East US 2, deploying a resource in East US 2 violates the Tenant Root Group policy.

Key Concept

Azure Policy and RBAC inheritance and evaluation within Management Group hierarchies
Estimated Time:3m 0s
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic