Examkin

Question

Difficulty: HardAzure Policy Definitions, Initiatives, and Assignments

An organization has an Azure environment structured with a Management Group named Corp-MG, a Subscription named Sub-Prod, and a Resource Group named RG-Core. You assign various Azure Policy definitions at these scopes. You need to match the policy effect configured for a Virtual Machine deployment to its corresponding operational behavior when an administrator attempts to deploy a new Virtual Machine resource named VM-App-01 into RG-Core.

Match each Azure Policy effect on the left to its corresponding operational behavior on the right.

  • ModifyAlters the properties or tags of the virtual machine before the request is sent to the compute resource provider, and requires a managed identity for remediation.
  • DeployIfNotExistsTriggers a template deployment to configure diagnostic settings for the virtual machine after a successful creation, and requires a managed identity.
  • DenyPrevents the virtual machine deployment request from reaching the compute resource provider if the virtual machine size is not in the allowed list.
  • AuditIfNotExistsChecks if a dependency, such as a log analytics agent extension, is deployed on the virtual machine, marking the virtual machine as non-compliant without blocking deployment if missing.

Answer

Modify matches the behavior of altering properties or tags before the request reaches the resource provider and requiring a managed identity. DeployIfNotExists matches triggering a template deployment after successful creation and requiring a managed identity. Deny matches preventing the deployment request from reaching the resource provider if non-compliant. AuditIfNotExists matches checking if a dependency exists and marking the resource non-compliant without blocking if it is missing.
The matching correctly pairs each Azure Policy effect with its precise execution phase, behavior, and managed identity requirements: Modify alters resource tags or properties before creation/update; DeployIfNotExists deploys a resource template after a successful deployment; Deny blocks non-compliant deployment requests pre-evaluation; AuditIfNotExists audits dependent resources post-evaluation without blocking.

Step-by-Step Solution

1
Analyze the execution timing of each policy effect.
Modify and Deny run before the resource provider is called. DeployIfNotExists and AuditIfNotExists run after the resource provider successfully processes the request.
Understanding execution phases distinguishes between pre-deployment enforcement (blocking or altering requests) and post-deployment auditing or remediation.
2
Evaluate the requirement for managed identities.
Effects that perform write operations (Modify and DeployIfNotExists) require a managed identity to remediate existing resources or deploy new ones.
Remediation tasks require Azure Role-Based Access Control (RBAC) permissions, which are granted to the policy assignment's managed identity.
3
Differentiate between conditional checks (AuditIfNotExists vs DeployIfNotExists) and enforcement checks (Deny vs Modify).
Deny blocks the request. Modify alters the request. AuditIfNotExists only logs compliance status. DeployIfNotExists deploys missing templates.
This matches each specific policy effect to its corresponding scenario behavior for VM-App-01 in RG-Core.

Key Concept

Azure Policy effects determine how compliance is evaluated and enforced during resource creation or update.
Estimated Time:2m 0s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments