Your organization uses the following Azure resource hierarchy: * A Management Group named … — Microsoft Azure Administrator (AZ-104)

Your organization uses the following Azure resource hierarchy:
* A Management Group named Corp-MG.
* Two subscriptions under Corp-MG named Prod-Sub and Dev-Sub.
* Prod-Sub contains two resource groups: RG-Core and RG-Data.
* Dev-Sub contains a resource group named RG-Dev.

The following Azure Policy configurations are in place:

Scope	Assignment / Policy Detail	Effect	Allowed/Required Values	Exclusions
Corp-MG	Initiative Gov-Initiative containing: - VM SKU restriction policy - Resource tag enforcement policy	Deny Deny	- Standard_D2s_v3, Standard_D4s_v3 - Tag Environment must exist	None
Prod-Sub	Policy Region-Restriction	Deny	East US, West US	RG-Data

You need to identify which resource deployment attempts will succeed.

Which two deployment attempts will complete successfully? (Select two.)

A Standard_D2s_v3 virtual machine deployed to RG-Data in North Europe with the tag Environment set to Production.Answer
A Standard_D4s_v3 virtual machine deployed to RG-Core in East US with the tag Environment set to Production.Answer
C
A Standard_D2s_v3 virtual machine deployed to RG-Core in North Europe with the tag Environment set to Production.
D
A Standard_B2s virtual machine deployed to RG-Data in West US with the tag Environment set to Production.
E
A Standard_D4s_v3 virtual machine deployed to RG-Dev in West US without any tags.

Answer

The two successful deployments are: (1) A Standard_D2s_v3 virtual machine deployed to RG-Data in North Europe with the tag Environment set to Production, and (2) A Standard_D4s_v3 virtual machine deployed to RG-Core in East US with the tag Environment set to Production.

The correct deployments are those that satisfy the management group VM SKU and tag requirements, while also respecting the subscription region limits or qualifying for their exclusions. Specifically, the Standard_D2s_v3 VM deployed to RG-Data in North Europe with the Environment tag succeeds because the VM SKU and tags are valid, and RG-Data is excluded from the region restrictions. The Standard_D4s_v3 VM in RG-Core (East US) succeeds because its SKU, region, and tags are all within the allowed limits.

Step-by-Step Solution

Evaluate the management group (Corp-MG) policy constraints for all deployment attempts.

The Corp-MG level policy requires the VM SKU to be either Standard_D2s_v3 or Standard_D4s_v3, and requires the Environment tag to be present. This blocks the attempt using Standard_B2s and the attempt without any tags.

Since both subscriptions inherit from Corp-MG, all resources under them must comply with these policies.

Evaluate the subscription-level (Prod-Sub) region-restriction policy for the remaining attempts.

The subscription policy restricts deployments to East US and West US, but excludes RG-Data. Therefore, a VM deployed in RG-Core must be in East US or West US, whereas a VM deployed in RG-Data can be in any region (such as North Europe).

Policy exclusions exempt the specified scopes from the policy assignment's evaluation rules.

Verify which deployments satisfy all applicable inherited and scope-specific policies.

The Standard_D2s_v3 VM in RG-Data (North Europe) succeeds due to the exclusion. The Standard_D4s_v3 VM in RG-Core (East US) succeeds because it complies with the region rule and all other inherited rules.

Only deployments that do not trigger a 'Deny' action from any active policy assignments will be allowed to complete.

Key Concept

Azure Policy evaluation logic takes into account hierarchical inheritance (from Management Groups down to Resource Groups) and respects explicit exclusions configured on individual policy assignments.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics