Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

Your company has an Azure subscription named Sub-Development that contains two resource groups named RG-CoreApp and RG-Testing. You need to implement a governance strategy that enforces the following requirements:
* All virtual machines deployed to Sub-Development must include a tag named Environment.
* The Environment tag value must be either Dev or Test.
* Any virtual machine deployment that does not meet these tagging requirements must be prevented.
* Virtual machines deployed to RG-Testing must be allowed to deploy without any tag requirements.

Which two of the following actions should you perform to meet these requirements?

  1. Assign an Azure Policy definition with the Deny effect to the Sub-Development subscription, configured to target resources that do not have the Environment tag set to Dev or Test.Answer
  2. Configure the resource group RG-Testing as an exclusion in the Sub-Development policy assignment.Answer
  3. C
    Assign an Azure Policy definition with the AuditIfNotExists effect to the Sub-Development subscription.
  4. D
    Assign an Azure Policy definition with the Disabled effect to the RG-Testing resource group.

Answer

To implement this governance strategy, you must assign a policy definition with the Deny effect to the Sub-Development subscription and configure the RG-Testing resource group as an exclusion in that policy assignment.
To block non-compliant resources, a policy definition utilizing the Deny effect must be assigned at the subscription scope. To exempt specific environments from this restriction, the targeted resource group must be added to the policy assignment's exclusion list.

Step-by-Step Solution

1
Select the appropriate policy effect to prevent non-compliant deployments.
The Deny effect is chosen because it actively blocks Resource Manager deployment requests that do not match the defined criteria.
Other effects like Audit or AuditIfNotExists only evaluate compliance and log results, failing to prevent the creation of non-compliant resources.
2
Identify the target assignment scope and bypass requirements.
The policy assignment scope is set to the Sub-Development subscription, and the RG-Testing resource group is specified in the exclusion list.
Exclusions at the policy assignment level stop policy evaluation for all resources within the excluded scope, allowing untagged deployments in the testing resource group.

Key Concept

Azure Policy effects and assignment scope exclusions
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments