Examkin

Question

Difficulty: MediumAzure Policy Definitions, Initiatives, and Assignments

A company establishes the following Azure resource hierarchy:
- A Management Group named `Corp-MG`
- A subscription named `Sub-Production` located under `Corp-MG`
- A resource group named `RG-App-Prod` in `Sub-Production`
- A resource group named `RG-App-Shared` in `Sub-Production`

The following governance configurations are applied:
1. An Azure Policy initiative named `Gov-Initiative` is assigned at the `Sub-Production` subscription level. The initiative contains a policy definition that restricts allowed virtual machine SKUs to `Standard_D2s_v3` (Effect: `Deny`) and a policy definition that requires the `CostCenter` tag (Effect: `Audit`).
2. An exclusion is configured on the `Gov-Initiative` assignment for the `RG-App-Shared` resource group.
3. An Azure Policy definition that restricts storage account replication SKUs to `Standard_LRS` (Effect: `Deny`) is assigned directly to the `RG-App-Shared` resource group.

A technician attempts to perform the following operations:
- Operation 1: Create a virtual machine with the `Standard_F2s_v2` SKU in `RG-App-Prod` without any tags.
- Operation 2: Create a virtual machine with the `Standard_F2s_v2` SKU in `RG-App-Shared` without any tags.
- Operation 3: Create a storage account with the `Standard_GRS` SKU in `RG-App-Shared`.

Which two of the following outcomes will occur?

  1. Operation 1 is denied, and Operation 2 succeeds.Answer
  2. Operation 3 is denied, and Operation 2 succeeds.Answer
  3. C
    Operation 2 is denied because the Audit effect on the CostCenter tag policy blocks resource creation when tags are missing.
  4. D
    Operation 3 succeeds because the exclusion configured on the parent subscription policy disables all policy evaluations on the resource group.

Answer

The correct outcomes are: Operation 1 is denied, Operation 2 succeeds, and Operation 3 is denied.
Operation 1 is blocked by the inherited virtual machine SKU policy which contains a Deny effect. Operation 2 is permitted because its resource group is excluded from the subscription-level initiative assignment. Operation 3 is blocked by a policy directly assigned to the target resource group that restricts storage replication to LRS.

Step-by-Step Solution

1
Evaluate Operation 1 against the policy assignments.
Operation 1 is denied.
The virtual machine is being created in a resource group that inherits the subscription-level initiative. The initiative has a policy restricting VM SKUs to Standard_D2s_v3 with a Deny effect. Attempting to deploy a Standard_F2s_v2 VM triggers the Deny effect, blocking the operation.
2
Evaluate Operation 2 against the policy assignments.
Operation 2 succeeds.
Although the subscription-level initiative is inherited by default, the resource group has an explicit exclusion from this assignment. Thus, neither the VM SKU policy nor the tag policy applies, allowing the creation of the Standard_F2s_v2 VM.
3
Evaluate Operation 3 against the policy assignments.
Operation 3 is denied.
A separate policy is assigned directly to the resource group that denies storage account replication SKUs other than Standard_LRS. Attempting to create a Standard_GRS storage account triggers this Deny effect, blocking the operation.

Key Concept

Azure Policy evaluation rules, including inheritance, exclusions, and the difference between Deny and Audit effects.
Rate this question

Topics

Azure Policy Definitions, Initiatives, and Assignments