Examkin

Question

Difficulty: EasyAzure Policy Definitions, Initiatives, and Assignments

You configure the Azure resource hierarchy for a business unit. The hierarchy includes a Management Group named Global-MG, an Azure subscription named Sub-Finance, and two resource groups named RG-Core and RG-Sandbox.

You assign the 'Allowed locations' Azure Policy definition to Sub-Finance. The policy definition is configured to permit resource creation only in the East US or West US regions. You add RG-Sandbox to the exclusion list (Not Scopes) of this policy assignment.

What is the result when an administrator attempts to deploy a new storage account in the West Europe region within RG-Sandbox?

  1. The storage account is successfully created in West Europe.Answer
  2. B
    The deployment is blocked because the subscription-level policy assignment inherits to all resource groups.
  3. C
    The storage account is successfully created in West Europe but is automatically deleted by Azure Policy after the next compliance scan.
  4. D
    The deployment is redirected, and the storage account is created in East US to comply with the allowed locations list.

Answer

The storage account is successfully created in West Europe.
The correct answer is that the storage account is successfully created in West Europe. When a resource group is added to the exclusion list (Not Scopes) of a policy assignment, the policy is completely bypassed for any resources created within that resource group. Therefore, the restriction to East US or West US does not apply to RG-Sandbox.

Step-by-Step Solution

1
Analyze the policy assignment scope and exclusions.
The policy assignment target is the subscription Sub-Finance, but the resource group RG-Sandbox is explicitly excluded (Not Scopes).
Exclusions remove specific scopes from the evaluation of the policy assignment.
2
Determine the effect of the policy on the deployment request.
Since the resource is being deployed within the excluded RG-Sandbox resource group, the 'Allowed locations' policy is not evaluated for this deployment.
Azure Policy bypasses evaluation for any resources created within an excluded scope.
3
Determine the deployment outcome.
The deployment of the storage account in West Europe succeeds.
No policy constraints are active on RG-Sandbox to block the deployment.

Key Concept

Azure Policy exclusions (Not Scopes) prevent the policies assigned at higher scopes from being applied to the excluded resource groups or resources.
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments