Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

Your organization is implementing Azure Policy to enforce governance standards across multiple subscriptions. You need to match the specific operational compliance requirements with the correct Azure Policy effects. Match each operational requirement on the left to its corresponding Azure Policy effect on the right.

  • Block the creation or update of any resource that does not contain a required 'CostCenter' tag.Deny
  • Generate a compliance warning in the Azure Policy dashboard when a virtual machine is created without disaster recovery configured, without preventing the deployment.Audit
  • Automatically insert a default 'Environment' tag with the value 'Production' during resource creation if the tag is missing.Modify
  • Provision a diagnostic settings resource automatically if a newly deployed Key Vault does not have diagnostic logging enabled.DeployIfNotExists

Answer

To enforce the requirements, block resource creation with Deny, log non-compliance without blocking with Audit, insert default tags during creation with Modify, and automatically provision missing dependent resources with DeployIfNotExists.
Each requirement correctly maps to the corresponding Azure Policy effect: Deny blocks non-compliant requests; Audit logs non-compliant configurations; Modify adjusts tags or properties on the fly; and DeployIfNotExists deploys a template when a dependent resource is missing.

Step-by-Step Solution

1
Analyze the prevention requirement: 'Block the creation or update of any resource that does not contain a required tag.'
Identify that blocking resource deployment corresponds to the Deny effect.
Deny is the standard effect to enforce compliance by preventing non-conforming resource deployment requests at the Azure Resource Manager level.
2
Analyze the logging requirement: 'Generate a compliance warning... without preventing the deployment.'
Identify that logging non-compliance without interrupting deployment corresponds to the Audit effect.
Audit evaluates the resource and records non-compliance events in the dashboard without hindering resource creation or modifications.
3
Analyze the tag injection requirement: 'Automatically insert a default tag during resource creation if the tag is missing.'
Identify that inserting or altering tags or properties during creation matches the Modify effect.
Modify is optimized for adding, modifying, or removing tags and properties during resource creation or update via remediation tasks.
4
Analyze the dependent resource deployment requirement: 'Provision a diagnostic settings resource automatically if it is missing.'
Identify that deploying a nested or dependent template-based resource corresponds to the DeployIfNotExists effect.
DeployIfNotExists checks for the existence of a child/related resource and executes a template deployment to remediate if the resource is absent.

Key Concept

Azure Policy effects determine what action is taken when a policy definition is evaluated against resources.
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments