Examkin

Question

Difficulty: EasyAzure Policy

An administrator wants to prevent users from creating virtual machines in an Azure subscription unless they specify a business unit tag. The administrator also wants to ensure that any existing virtual machines that do not have this tag are identified without being altered. Which Azure service should be used to meet these requirements?

  1. Azure PolicyAnswer
  2. B
    Azure Role-Based Access Control (RBAC)
  3. C
    Azure Resource Locks
  4. D
    Azure Service Health

Answer

Azure Policy
Azure Policy is the correct service because it allows administrators to define rules that enforce resource properties, such as requiring tags. It evaluates resources at deployment time (blocking non-compliant deployments) and audits existing resources to flag them as non-compliant without altering them.

Step-by-Step Solution

1
Analyze the requirement to enforce a specific resource property (the presence of a business unit tag) during creation.
The requirement focuses on governing resource configurations rather than managing user permissions.
Enforcing resource configuration rules is a governance task managed by Azure Policy.
2
Analyze the requirement to identify existing non-compliant resources (virtual machines lacking the tag) without altering them.
Azure Policy evaluates existing resources and flags them as non-compliant without deleting, stopping, or modifying them.
This confirms that Azure Policy fits both the enforcement for new resources and the audit behavior for existing resources.

Key Concept

Azure Policy is used to enforce resource properties and evaluate compliance of resources.
Rate this question

Topics

Azure Policy

More questions from this topic