Examkin

Question

Difficulty: HardAzure Policy Definitions, Initiatives, and Assignments

An organization has an Azure resource hierarchy consisting of a Management Group named Corp-MG, a subscription named Sub-Production under Corp-MG, and three resource groups under Sub-Production: RG-App-Prod, RG-Database-Prod, and RG-Shared-Services.

The following policy assignments are active in the environment:
- Assignment 1: An Azure Policy definition that restricts allowed virtual machine SKUs to 'Standard_D2s_v3' and 'Standard_D4s_v3'. The policy effect is set to Deny. This policy is assigned at the Sub-Production subscription level with an exclusion configured for RG-Shared-Services.
- Assignment 2: A custom policy definition that denies the deployment of any resource if it does not have the 'Environment' tag with the value 'Production'. This policy is assigned at the Corp-MG Management Group level with no exclusions.

An administrator attempts to perform the following actions:
- Action 1: Deploy a virtual machine with SKU 'Standard_F4s' and the tag 'Environment: Production' in RG-Shared-Services.
- Action 2: Deploy a virtual machine with SKU 'Standard_D2s_v3' and no tags in RG-Database-Prod.

Which of the deployments will succeed?

  1. A
    Both Action 1 and Action 2 are blocked.
  2. B
    Action 2 succeeds, but Action 1 is blocked.
  3. Action 1 succeeds, but Action 2 is blocked.Answer
  4. D
    Both Action 1 and Action 2 succeed.

Answer

Action 1 succeeds, but Action 2 is blocked.
The correct option correctly evaluates both deployment scenarios. Action 1 is successful because the SKU restriction policy (Assignment 1) explicitly excludes the RG-Shared-Services resource group, and the required Environment tag is present, satisfying the inherited policy (Assignment 2). Action 2 fails because, despite having an allowed SKU, the target resource group inherits the custom tag policy from the management group, and the virtual machine is deployed without the mandatory Environment tag.

Step-by-Step Solution

1
Evaluate Action 1 against Assignment 1
Exempt from SKU restrictions
The deployment is targeted to RG-Shared-Services, which is explicitly configured as an exclusion under the subscription-level SKU policy assignment.
2
Evaluate Action 1 against Assignment 2
Allowed
The VM has the tag 'Environment' set to 'Production', which satisfies the tag policy inherited from the Corp-MG management group.
3
Evaluate Action 2 against Assignment 1
Allowed by SKU policy
The VM SKU is 'Standard_D2s_v3', which is one of the allowed SKUs listed in Assignment 1.
4
Evaluate Action 2 against Assignment 2
Blocked (Denied)
Assignment 2 is assigned at the Corp-MG level and is inherited by all resource groups under the subscription. Since the VM in RG-Database-Prod does not have the required tag, the policy triggers a Deny effect.

Key Concept

Azure Policy assignments, inheritance rules, exclusions, and evaluations of multiple active policies during resource deployment
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments