Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

An organization is configuring governance controls across their Azure subscriptions. Match each Azure Policy effect to the correct operational behavior that occurs during resource creation or update.

  • DenyBlocks the resource deployment request immediately and records a failed evaluation in the activity log.
  • AuditAllows the resource deployment request to succeed but generates a non-compliance event in the policy history.
  • ModifyApplies defined tag or property updates to the resource before the request is processed by the resource provider.
  • DeployIfNotExistsExecutes a nested Resource Manager template to perform remediation only after the resource is successfully deployed.

Answer

Deny matches blocking resource deployment requests; Audit matches allowing resource deployment but generating a non-compliance event; Modify matches applying defined tag or property updates before processing; DeployIfNotExists matches executing a nested Resource Manager template for remediation after successful deployment.
The correct pairings align each policy effect with its exact evaluation phase and system behavior: Deny blocks the request; Audit creates a compliance log without blocking; Modify alters properties before creation; and DeployIfNotExists deploys a template to remediate after creation.

Step-by-Step Solution

1
Determine the evaluation timing of each policy effect relative to the resource provider processing phase.
Deny, Audit, and Modify are evaluated and run before the resource provider processes the deployment. DeployIfNotExists is evaluated and runs after a successful resource creation or update.
This splits the effects into pre-deployment and post-deployment categories.
2
Distinguish between the outcomes of pre-deployment effects.
Deny blocks the deployment. Audit allows the deployment but creates a warning log. Modify alters tags/properties before the resource is deployed.
This maps the specific actions of Deny, Audit, and Modify to their descriptions.
3
Identify the remediation capability of DeployIfNotExists.
DeployIfNotExists runs a nested ARM template to install components or configure settings after the resource is created.
This matches the post-deployment effect to its template-based remediation behavior.

Key Concept

Azure Policy effects define the actions taken when resource properties match the rule conditions of a policy definition.
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments