Examkin

Question

Difficulty: HardAzure Policy Definitions, Initiatives, and Assignments

An organization implements an Azure governance model with the following hierarchy and configuration:

* A management group named `Tenant-MG` contains a child management group named `Biz-MG`.
* `Biz-MG` contains a subscription named `Sub-Finance`.
* `Sub-Finance` contains two resource groups named `RG-Prod` and `RG-Dev`.

The following policy assignments are applied:

* At `Biz-MG`, an Azure Policy Initiative named `Governance-Initiative` is assigned. An exclusion is configured on this assignment for the scope of `RG-Dev`. The initiative contains two policy definitions:
* A policy that denies the creation of resources without the tag `Env`.
* A policy that denies the creation of Storage Accounts unless the SKU is `Standard_LRS` or `Standard_GRS`.
* At `Sub-Finance`, a policy named `SKU-Limit-Policy` is assigned that denies the creation of Storage Accounts unless the SKU is `Standard_LRS`.

An administrator attempts to perform several deployments. Which deployment action will succeed?

  1. Creating a Storage Account with the Standard_LRS SKU and no tags in RG-DevAnswer
  2. B
    Creating a Storage Account with the Standard_GRS SKU and the tag Env: Production in RG-Prod
  3. C
    Creating a Storage Account with the Standard_LRS SKU and no tags in RG-Prod
  4. D
    Creating a Storage Account with the Premium_LRS SKU and the tag Env: Development in RG-Dev

Answer

Creating a Storage Account with the Standard_LRS SKU and no tags in RG-Dev
Creating a Storage Account with the Standard_LRS SKU and no tags in RG-Dev is the only successful action. The management group level assignment of Governance-Initiative contains an exclusion for RG-Dev, meaning the tag requirement does not apply to this resource group. However, RG-Dev still inherits SKU-Limit-Policy from the subscription level, which allows the Standard_LRS SKU. Since the deployment meets the Standard_LRS SKU requirement and is exempt from the tag policy, it succeeds.

Step-by-Step Solution

1
Evaluate the management group policy assignment (Governance-Initiative) for the target resource group.
For RG-Dev, the policy initiative is not evaluated because RG-Dev is explicitly configured as an exclusion on the assignment. For RG-Prod, the policy initiative is active and enforces both the Env tag requirement and the SKU restriction (Standard_LRS or Standard_GRS).
Policy exclusions prevent the assignment from applying to the specified scope and any of its children.
2
Evaluate the subscription policy assignment (SKU-Limit-Policy) for the target resource group.
Both RG-Prod and RG-Dev inherit the SKU-Limit-Policy from Sub-Finance. This policy restricts all Storage Account creations to the Standard_LRS SKU.
Azure Policies are inherited by all child resources and scopes beneath the assignment level unless an explicit exclusion is defined.
3
Analyze each deployment action against the combined policy compliance results.
Creating a Storage Account with Standard_LRS and no tags in RG-Dev is the only successful action because the management group's tag requirement is bypassed via the exclusion, and the SKU matches the subscription's allowed SKU.
All active Deny policies across all inherited scopes must evaluate to allowed for a deployment to succeed.

Key Concept

Azure Policy evaluation order, inheritance, and exclusions
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments