Examkin

Question

Difficulty: Very hardAzure Policy Definitions, Initiatives, and Assignments

An enterprise manages its Azure resource hierarchy with a Management Group named Production-MG, which contains a subscription named Prod-Sub-01. Prod-Sub-01 contains two resource groups named RG-Core-App and RG-Core-Data.

The following Azure Policy assignments are active:
- An initiative definition named Corp-Governance-Initiative is assigned at Production-MG. The assignment contains an exclusion for the resource group RG-Core-App. The initiative contains two policy definitions: Policy-Tag (denies resource creation if the Environment tag is missing) and Policy-SKU-A (denies VM deployment unless the size is Standard_D2s_v5 or Standard_D8s_v5).
- A policy definition named Policy-SKU-B is assigned directly to Prod-Sub-01. This policy denies VM deployment unless the size is Standard_D2s_v5 or Standard_D4s_v5.
- A policy definition named Policy-SKU-C is assigned directly to RG-Core-App. This policy denies VM deployment unless the size is Standard_D4s_v5.

Which of the following deployments will successfully complete?

  1. Deploying a virtual machine with size Standard_D4s_v5 in RG-Core-App without the Environment tagAnswer
  2. B
    Deploying a virtual machine with size Standard_D2s_v5 in RG-Core-App with the Environment tag
  3. C
    Deploying a virtual machine with size Standard_D4s_v5 in RG-Core-Data with the Environment tag
  4. D
    Deploying a virtual machine with size Standard_D8s_v5 in RG-Core-Data with the Environment tag

Answer

Deploying a virtual machine with size Standard_D4s_v5 in RG-Core-App without the Environment tag
Deploying a Standard_D4s_v5 VM in RG-Core-App without the Environment tag completes successfully because RG-Core-App is excluded from the management group's policy initiative. Consequently, the tag requirement and the management group's SKU restrictions do not apply to this scope. The subscription policy allows the Standard_D4s_v5 SKU, and the resource group policy explicitly requires the Standard_D4s_v5 SKU, allowing the deployment to satisfy all applicable policy definitions.

Step-by-Step Solution

1
Determine the scope of the management group initiative assignment and exclusions.
The Corp-Governance-Initiative is assigned at Production-MG, meaning it inherits down to Prod-Sub-01, RG-Core-App, and RG-Core-Data. However, RG-Core-App is listed as an exclusion on this assignment. Therefore, Policy-Tag and Policy-SKU-A do not evaluate deployments within RG-Core-App.
Exclusions on policy assignments prevent the policies from being evaluated on resources within the excluded scope.
2
Analyze the policies applied to RG-Core-App.
The active policies are Policy-SKU-B (assigned at Prod-Sub-01, allowing Standard_D2s_v5 or Standard_D4s_v5) and Policy-SKU-C (assigned at RG-Core-App, allowing Standard_D4s_v5). Combining these requirements, only Standard_D4s_v5 is allowed in RG-Core-App. The Environment tag is not required here.
Azure Policy evaluations are cumulative; resources must satisfy all applicable policies in the hierarchy.
3
Analyze the policies applied to RG-Core-Data.
Since RG-Core-Data is not excluded, it is subject to all parent scopes. The active policies are Policy-Tag (requires Environment tag), Policy-SKU-A (allows Standard_D2s_v5 or Standard_D8s_v5), and Policy-SKU-B (allows Standard_D2s_v5 or Standard_D4s_v5). To succeed in RG-Core-Data, a VM must have the Environment tag and be size Standard_D2s_v5 (the intersection of SKU-A and SKU-B).
Resources must comply with the union of restrictions (the intersection of allowed sets) across all assigned policies in their hierarchical path.
4
Evaluate the deployment options against the determined compliance rules.
Deploying a Standard_D4s_v5 VM in RG-Core-App without the tag succeeds because the tag policy does not apply and the SKU is allowed by both Policy-SKU-B and Policy-SKU-C.
This is the only deployment scenario where all applicable policy conditions evaluate to allowed.

Key Concept

Azure Policy Scope Inheritance, Exclusions, and Cumulative Evaluation Logic
Estimated Time:3m 0s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments