Examkin

Question

Difficulty: MediumAzure Policy

To enforce data transit encryption, a security team assigns a policy definition requiring secure transfer (HTTPS) to a resource group. At the time of assignment, the resource group already contains several storage accounts that do not have HTTPS enabled. Is the statement that the policy will automatically alter or delete these existing, non-compliant storage accounts to enforce the rule true or false?

Answer: Answer

Answer

False
The correct answer is false because Azure Policy evaluates pre-existing resources against newly assigned policies and marks them as non-compliant in the compliance dashboard. It does not automatically delete or modify them to enforce compliance.

Step-by-Step Solution

1
Analyze how Azure Policy evaluates existing resources after a new policy is assigned.
Azure Policy scans existing resources during its standard evaluation cycle (typically within 30 minutes of assignment, and then every 24 hours).
To identify compliance state without interrupting existing workloads.
2
Determine the action taken on non-compliant existing resources.
Existing resources that violate the policy are flagged as non-compliant in the Azure Policy dashboard, but they are not deleted, stopped, or automatically modified.
Azure Policy prevents non-compliant resources from being created or updated when using the Deny effect, but it does not destructively modify or remove resources that were already deployed before the policy was put in place.

Key Concept

Azure Policy compliance evaluation for existing resources
Estimated Time:45s
Rate this question

Topics

Azure Policy

More questions from this topic