Examkin

Question

Difficulty: MediumAzure Policy

An administrator with the Owner role on an Azure subscription attempts to deploy a new virtual machine to the East US region. However, an Azure Policy definition with a Deny effect is assigned to the subscription, restricting all resource deployments to the West US region. What is the outcome of this deployment attempt?

  1. A
    The deployment succeeds because the Owner role grants administrative permissions that bypass Azure Policy restrictions.
  2. B
    The deployment succeeds, but the virtual machine is automatically relocated to the West US region to comply with the policy.
  3. The deployment is blocked because Azure Policy restrictions are enforced regardless of the user's role-based access control (RBAC) privileges.Answer
  4. D
    The deployment succeeds, but the virtual machine is flagged as non-compliant in the Azure Policy dashboard.

Answer

The deployment is blocked because Azure Policy restrictions are enforced regardless of the user's role-based access control (RBAC) privileges.
Azure Policy evaluations occur at the Azure Resource Manager level before any resource is created. A Deny policy blocks non-compliant deployment requests immediately, and this enforcement applies to all users, including those assigned the Owner role. RBAC roles determine who has access, but Azure Policy defines the compliance boundaries of the resources.

Step-by-Step Solution

1
Identify the assigned policy's effect and rules.
A policy with a Deny effect restricts deployments to the West US region.
This establishes that any deployment attempt to a different region (like East US) triggers a block unless bypassed.
2
Evaluate the relationship between the user's RBAC role and Azure Policy.
The user is a subscription Owner, but Azure Policy is applied at the resource deployment level, independent of RBAC.
RBAC determines what operations a user can initiate, but Azure Policy enforces properties of the resources being created.
3
Determine the final outcome of the deployment request.
The deployment request fails at the validation stage and is blocked.
Because the policy uses the Deny effect, the deployment is rejected before resource creation begins.

Key Concept

Interaction between Azure Policy and Role-Based Access Control (RBAC)
Rate this question

Topics

Azure Policy

More questions from this topic