Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

You manage the following Azure resource hierarchy:

* A management group named `MG-Production`
* A subscription named `Sub-App` that is a child of `MG-Production`
* Two resource groups in `Sub-App` named `RG-Web` and `RG-Data`

You assign an Azure Policy definition named `Allow-SKUs` (which uses a `Deny` effect to restrict VM SKUs to `Standard_D2s_v5` or `Standard_D4s_v5`) to `MG-Production`. You configure the assignment with an exclusion for `RG-Data`.

You also assign an Azure Policy initiative named `Audit-Compliance` (which contains a policy definition that audits resources missing the `Project` tag using the `Audit` effect) to `Sub-App`.

You attempt to deploy the following virtual machines:

* `VM1`: A `Standard_D8s_v5` VM without the `Project` tag in `RG-Web`
* `VM2`: A `Standard_D8s_v5` VM without the `Project` tag in `RG-Data`

What is the outcome of these deployment attempts?

  1. VM1 deployment is blocked by the policy definition. VM2 is deployed successfully but marked as non-compliant.Answer
  2. B
    Both VM1 and VM2 deployments are blocked by the policy definition.
  3. C
    VM1 is deployed successfully but marked as non-compliant. VM2 deployment is blocked by the policy initiative.
  4. D
    Both VM1 and VM2 are deployed successfully, and both are marked as non-compliant.

Answer

VM1 deployment is blocked by the policy definition. VM2 is deployed successfully but marked as non-compliant.
The correct answer is correct because VM1 is deployed in RG-Web, which inherits the Allow-SKUs policy assignment from MG-Production. Since the VM SKU (Standard_D8s_v5) is not allowed and the policy uses a Deny effect, the deployment is blocked. VM2 is deployed in RG-Data, which is explicitly excluded from the Allow-SKUs policy assignment, so its deployment is not blocked by the SKU restriction. However, VM2 is subject to the Audit-Compliance initiative assigned to Sub-App. Because the initiative uses the Audit effect for missing tags and VM2 does not have the Project tag, the deployment succeeds but the resource is marked as non-compliant.

Step-by-Step Solution

1
Evaluate policy inheritance and exclusions for VM1
VM1 is deployed in RG-Web under Sub-App. It inherits the Allow-SKUs policy assignment from MG-Production. Since the VM SKU (Standard_D8s_v5) is not allowed by this policy and its effect is Deny, the deployment is blocked.
Ensure that standard inheritance applies to RG-Web as there are no exclusions configured for it.
2
Evaluate policy inheritance and exclusions for VM2
VM2 is deployed in RG-Data under Sub-App. Since RG-Data is explicitly excluded from the Allow-SKUs policy assignment, VM2 is not blocked by the SKU restriction.
Identify child-level scope exclusions which override higher-level policy assignments.
3
Evaluate the initiative effect on VM2
VM2 is subject to the Audit-Compliance initiative assigned to Sub-App. It lacks the Project tag. Because the initiative's policy definition uses the Audit effect, VM2 is deployed successfully but marked as non-compliant.
Distinguish between Deny (active blocking) and Audit (passive monitoring and logging of non-compliance) policy effects.

Key Concept

Azure Policy scope assignment, inheritance, exclusions, and evaluation effects
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments