Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

An organization has the following Azure resource hierarchy:

* A Management Group named MG-Production
* An Azure subscription named Sub-App1 under MG-Production
* A Resource Group named RG-Data within Sub-App1

The administrator wants to ensure that all Azure Storage Accounts created within the hierarchy are configured to block public blob access. If a storage account is deployed with public access enabled, it must be automatically remediated by setting the property to disabled, without blocking the resource creation.

Which assignment scope and policy effect should the administrator use to meet these requirements?

  1. Assign the policy to MG-Production and use the Modify effect.Answer
  2. B
    Assign the policy to MG-Production and use the Deny effect.
  3. C
    Assign the policy to RG-Data and use the Audit effect.
  4. D
    Assign the policy to Sub-App1 and use the Append effect.

Answer

Assign the policy to MG-Production and use the Modify effect.
Assigning the policy to the management group MG-Production ensures it applies to all subscriptions and resource groups under it, including Sub-App1 and RG-Data. The Modify effect is used to add, update, or remove properties or tags during resource creation or update, enabling automatic remediation without blocking the deployment.

Step-by-Step Solution

1
Analyze the scope requirement
The requirement states that the policy must apply to all storage accounts created within the hierarchy. Assigning the policy to the parent Management Group (MG-Production) ensures inheritance down to all child subscriptions (Sub-App1) and resource groups (RG-Data).
Azure Policy assignments at a higher scope are inherited by all child resources and scopes.
2
Identify the required policy effect
The policy must automatically remediate the resource (set public access to disabled) without blocking the deployment. The Modify effect is designed to add or modify properties during resource creation or update.
The Modify effect allows updating resource properties in-flight during deployment, whereas Deny blocks creation and Audit only reports compliance status.
3
Combine scope and effect
The correct configuration is to assign the policy at MG-Production with the Modify effect.
This satisfies both the hierarchy-wide enforcement scope and the non-blocking remediation requirement.

Key Concept

Azure Policy Scope and Effects
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments