Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

An organization has an Azure management group named MG-Finance. A child subscription named Sub-Analytics is under MG-Finance. Within Sub-Analytics, there is a resource group named RG-Reporting.

An administrator configures the following Azure Policy settings:
1. A policy definition that requires a cost-center tag on resources is assigned to MG-Finance with the effect set to Deny. An exclusion is configured on this assignment for RG-Reporting.
2. A policy definition that audits missing cost-center tags on resources is assigned to Sub-Analytics with the effect set to Audit. There are no exclusions configured for this assignment.

An administrator attempts to deploy an Azure SQL database without a cost-center tag into RG-Reporting.

Which of the following describes the outcome of this deployment?

  1. A
    The deployment is blocked, and the Azure SQL database creation fails.
  2. B
    The deployment succeeds, and the missing cost-center tag is automatically appended to the Azure SQL database.
  3. The deployment succeeds, and the Azure SQL database is flagged as non-compliant in Azure Policy compliance reporting.Answer
  4. D
    The deployment is blocked, and a policy remediation task is automatically initiated to apply the tag.

Answer

The deployment succeeds, and the Azure SQL database is flagged as non-compliant in Azure Policy compliance reporting.
The correct answer states that the deployment succeeds, and the Azure SQL database is flagged as non-compliant in Azure Policy compliance reporting. This is because the Deny policy assigned at the management group level includes an exclusion for the target resource group, preventing it from blocking the database creation. However, the Audit policy assigned at the subscription level inherits downward without exclusions, which permits resource deployment while correctly identifying it as non-compliant in compliance dashboards.

Step-by-Step Solution

1
Evaluate the management group-level policy assignment.
The policy has a Deny effect but explicitly excludes the destination resource group (RG-Reporting). Therefore, the Deny action is bypassed.
Exclusions at lower scopes override policy assignments made at higher scopes.
2
Evaluate the subscription-level policy assignment.
The Audit policy assigned to Sub-Analytics has no exclusions and applies to the child resource group (RG-Reporting).
Policies assigned to subscriptions are inherited by all child resource groups unless explicitly excluded.
3
Determine the resource creation behavior under the Audit policy effect.
The resource deployment is allowed to proceed to completion, and Azure Policy updates the compliance status of the resource to non-compliant.
The Audit effect logs compliance evaluation results without blocking resource creation or modification.

Key Concept

Understanding policy assignment scopes, inheritance, exclusions, and the behavioral difference between Deny and Audit effects.

Alternative Method

Instead of checking compliance status via the Azure Portal UI, administrators can use Azure Resource Graph queries to fetch compliance states programmatically by querying the 'AdvisorResources' or 'PolicyStates' tables.
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments