Question

Difficulty: MediumAzure Resources, Resource Groups, Subscriptions, and Management Groups

An Azure administrator applies a policy at a management group level to restrict virtual machine sizes. The administrator claims that a child subscription can override this policy by applying a different policy at the resource group level to allow those restricted sizes. Is this claim true or false?

Answer: Answer

Answer

The statement is false because Azure Policy inheritance is cumulative and restrictions applied at a higher scope, such as a management group, cannot be overridden or bypassed by policies at a lower scope.

The correct answer is false because Azure Policy uses a cumulative evaluation model. Inherited policies from higher scopes (like management groups) are enforced across all child scopes, and lower-level policies cannot override these restrictions.

Step-by-Step Solution

1

Analyze the policy hierarchy and inheritance rules in Azure.

Policies applied at a parent scope (e.g., Management Group) are inherited by all child scopes (Subscriptions, Resource Groups, and Resources).

Governance and security controls in Azure are designed to flow down the hierarchy to ensure compliance.

2

Evaluate how conflicting policies at different scopes are resolved.

Azure Policy is cumulative. If any policy at any level denies an action, the action is blocked.

Azure does not support a 'permit overrides deny' mechanism for policy inheritance.

3

Determine the validity of the administrator's claim.

The claim that a resource group policy can override a management group policy is false.

Since policies are cumulative, the restriction from the management group remains active and cannot be bypassed at the resource group level.

Key Concept

Azure Policy inheritance and cumulative evaluation

Rate this question

Topics

Azure Resources, Resource Groups, Subscriptions, and Management Groups