Examkin

Question

Difficulty: EasyAzure Policy Definitions, Initiatives, and Assignments

An administrator manages an Azure environment with a Management Group named Tenant-MG. Under Tenant-MG, there is a Subscription named Sub-01 containing a Resource Group named RG-01. A policy definition is created to prevent users from deploying virtual machines of a specific SKU size. The policy must block any deployment attempt that violates this rule within the Resource Group. Which Azure Policy effect should be used in the policy definition to block the deployment of non-compliant virtual machines?

  1. DenyAnswer
  2. B
    Audit
  3. C
    DeployIfNotExists
  4. D
    Disabled

Answer

Deny
The Deny effect prevents resource creation or modification requests that do not comply with the policy definition. In this scenario, it immediately blocks the deployment of virtual machines of the restricted SKU size.

Step-by-Step Solution

1
Analyze the compliance requirement
The requirement states that the deployment of non-compliant virtual machines must be blocked.
Identifying the desired outcome is the first step in selecting the correct policy effect.
2
Evaluate the behavior of each policy effect option
The Deny effect prevents the creation or update of resources that do not match the policy rules, while Audit only logs warnings and DeployIfNotExists deploys missing resources.
Comparing the policy effects determines which one achieves the goal of blocking the deployment.
3
Select the correct effect
Select the Deny effect.
Deny is the only effect that directly blocks resource creation requests upon policy evaluation failure.

Key Concept

Azure Policy effects determine what happens when a resource is evaluated against a policy rule during deployment or modification.
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments