Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

An administrator manages an Azure subscription named Sub-Core that contains two resource groups named RG-Shared and RG-Secure.

The administrator must implement Azure Policy to enforce the following governance requirements:
1. All resources created within the subscription must include a tag named CostCenter. If the tag is missing, the resource deployment must be blocked.
2. Virtual machines deployed in RG-Secure must only use the Standard_D2s_v3 size. Virtual machines in RG-Shared must be allowed to use any size.

To meet the governance requirements with the minimum number of policy assignments, which two actions should the administrator perform?

  1. Assign the "Require a tag on resources" policy definition at the Sub-Core subscription scope.Answer
  2. Assign the "Allowed virtual machine size SKUs" policy definition at the RG-Secure resource group scope.Answer
  3. C
    Assign a policy initiative containing both policy definitions at the Sub-Core subscription scope, and add RG-Shared to the excluded scopes list.
  4. D
    Assign a policy initiative containing both policy definitions at the Sub-Core subscription scope, and configure the VM SKU policy parameter to apply only to RG-Secure.

Answer

Assigning the tag requirement policy at the subscription scope and the virtual machine size policy at the specific resource group scope.
To meet the governance requirements with the minimum number of assignments, the policy definitions must be assigned at their respective scopes. Assigning the tag enforcement policy at the subscription level ensures that all resources inside both resource groups are evaluated. Assigning the virtual machine size restriction policy at the resource group level ensures it only affects the specific resource group, while allowing other resource groups to remain unrestricted.

Step-by-Step Solution

1
Identify the scopes of the governance requirements.
The tag requirement applies subscription-wide (Sub-Core), whereas the VM size restriction applies only to a specific resource group (RG-Secure).
Determining the correct scopes is necessary to minimize assignments and avoid unintended policy inheritance.
2
Evaluate the use of a policy initiative with exclusions.
Using an initiative with an exclusion for RG-Shared would fail to enforce the tag requirement on resources in RG-Shared.
Exclusion scopes remove the entire assignment (and thus all policies in the initiative) from the excluded scope.
3
Select the appropriate assignment scope for each individual policy.
Assigning the tag policy at the subscription level and the VM SKU policy at the RG-Secure level meets all criteria with exactly two assignments.
This configuration correctly scopes each policy without requiring exemptions or compromising the tag enforcement policy.

Key Concept

Azure Policy Assignment Scopes and Exclusions
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments