Examkin

Question

Difficulty: HardAzure Policy

An administrator assigns an Azure Policy definition that blocks public network access to storage accounts (using the 'Deny' effect) at a management group level. A developer subsequently creates a new subscription under this management group, creates a new resource group within that subscription, and attempts to deploy a storage account with public network access enabled. The deployment will be blocked due to policy inheritance. Is this statement true?

Answer: Answer

Answer

True
The statement is true because Azure Policy assignments are inherited down the resource hierarchy (Management Groups -> Subscriptions -> Resource Groups -> Resources). Any resources created in child scopes, even after the policy is assigned, must comply with the policy. The 'Deny' effect actively blocks the creation of non-compliant resources.

Step-by-Step Solution

1
Determine the policy assignment scope and inheritance behavior.
The policy is assigned at the management group level, meaning the policy rule is inherited by all child scopes, including any subscriptions and resource groups nested beneath it.
Azure governance follows a hierarchy where child scopes automatically inherit policy assignments from parent scopes.
2
Evaluate the impact on newly created resources and scopes.
Newly created subscriptions and resource groups under the management group immediately inherit the active policy definition.
Inheritance is dynamic and applies to all current and future resources within the scope of the assignment.
3
Determine the effect of the policy on the deployment attempt.
The 'Deny' effect blocks the creation of the non-compliant storage account.
The 'Deny' effect is evaluated during resource creation or update and prevents the deployment if it does not comply with the policy rules.

Key Concept

Azure Policy inheritance and enforcement scopes
Rate this question

Topics

Azure Policy

More questions from this topic