Examkin

Question

Difficulty: Very hardAzure Resources, Resource Groups, Subscriptions, and Management Groups

An organization plans to implement a new resource governance model in Azure with the following hierarchy and configuration:

- A management group named Group-A contains a subscription named Sub-1.
- An Azure Policy is assigned to Group-A that denies the creation of resources in any region other than East US.
- A resource group named RG-1 is created in East US under Sub-1, and a tag named 'Environment: Production' is applied directly to RG-1.
- An administrator attempts to deploy a virtual network named VNet-1 in the West US region inside RG-1.

Which of the following statements correctly describes the result of this deployment attempt?

  1. A
    The deployment of the virtual network will succeed, and the virtual network will automatically inherit the environment tag from the resource group.
  2. B
    The deployment of the virtual network will fail because Azure requires all resources to be deployed in the same region as their containing resource group.
  3. The deployment of the virtual network will fail because the policy applied to the management group is inherited by the subscription and blocks resource creation in the West US region.Answer
  4. D
    The deployment of the virtual network will succeed in the West US region, but it will be automatically placed in a nested resource group under the main resource group.

Answer

The deployment of the virtual network will fail because the policy applied to the management group is inherited by the subscription and blocks resource creation in the West US region.
The correct option explains that Azure Policy inheritance flows down from the management group to the subscription and eventually to resources. Because the policy restricts resource creation to the East US region, any attempt to deploy a resource in West US will fail. The location of the resource group does not bypass this policy enforcement.

Step-by-Step Solution

1
Analyze the management group hierarchy and policy inheritance.
The Azure Policy denying resource creation outside of East US is applied to the parent management group (Group-A). This policy is inherited by the child subscription (Sub-1) and applies to all deployments within it.
To determine what rules restrict resource creation in the target environment.
2
Evaluate the deployment location of the resource group and the resource.
The resource group (RG-1) is in East US (allowed by policy), but the virtual network (VNet-1) is targeted for West US (denied by policy).
To verify if the resource's region violates the inherited policy.
3
Determine if the resource group location can bypass subscription-level policies, or if the resource is required to match the resource group's location.
Resource group location does not bypass inherited policies, and Azure allows resources to be in different regions than their resource groups. However, the policy applies to the resource itself, meaning VNet-1's deployment is blocked.
To resolve whether the deployment succeeds or fails based on region configurations and policy enforcement.
4
Verify tag inheritance and nesting rules for the proposed resources.
Resources do not inherit tags from their resource groups, and resource groups cannot be nested. Therefore, options suggesting success with tag inheritance or nesting are incorrect.
To eliminate incorrect options and confirm the correct behavior of the deployment.

Key Concept

Azure resource hierarchy, policy inheritance, and resource group properties
Rate this question

Topics

Azure Resources, Resource Groups, Subscriptions, and Management Groups