Examkin

Question

Difficulty: MediumAzure Policy

To enforce configuration standards, a security team configures an Azure Policy definition with a Deny effect on a target resource group. Is the following statement true or false? Any pre-existing resources within the resource group that violate this policy will be automatically deleted by Azure Policy to maintain compliance.

Answer: Answer

Answer

The statement is false. Azure Policy does not automatically delete existing resources that are non-compliant; it only flags them as non-compliant in the portal.
The correct answer is false because Azure Policy does not take destructive actions like deleting or stopping existing resources when a new policy definition is assigned. Instead, it identifies them as non-compliant in compliance reports, allowing administrators to perform remediation manually or via a remediation task for policies configured with remediation effects.

Step-by-Step Solution

1
Analyze the action of the Deny effect in Azure Policy.
The Deny effect prevents new resource deployments or updates to existing resources that do not comply with the policy definition.
This acts as a preventative guardrail for resource configuration.
2
Determine the impact of the policy on existing, pre-existing resources in the resource group.
Existing resources are evaluated against the policy and, if they violate it, their compliance state is reported as non-compliant. They are not modified, stopped, or deleted.
Azure Policy is designed to provide visibility and prevent new compliance issues without causing destructive actions or service disruptions to running resources.

Key Concept

Azure Policy evaluation of pre-existing resources and the preventative nature of the Deny effect.
Rate this question

Topics

Azure Policy

More questions from this topic