Examkin

Question

Difficulty: HardAzure Policy

An organization has an Azure resource group named RG-Production that contains ten existing virtual machines. None of these virtual machines have any tags. An administrator assigns an Azure Policy definition to RG-Production that denies the deployment of any resource that does not contain a tag named 'CostCenter'.

A developer who is assigned the Owner role for RG-Production attempts to perform two tasks:
1. Deploy a new virtual machine without specifying any tags.
2. Start one of the existing virtual machines.

What is the outcome of these tasks?

  1. The deployment of the new virtual machine is blocked, but the existing virtual machine starts successfully.Answer
  2. B
    Both tasks are blocked because the existing virtual machines in the resource group must be compliant before any further operations can occur.
  3. C
    The deployment of the new virtual machine is successful because the Owner role grant overrides all Azure Policy restrictions.
  4. D
    The deployment of the new virtual machine is blocked, and the existing virtual machines are automatically stopped or deleted to enforce compliance.

Answer

The deployment of the new virtual machine is blocked, but the existing virtual machine starts successfully.
The option stating that the deployment of the new virtual machine is blocked, but the existing virtual machine starts successfully is correct. Azure Policy evaluates resource compliance during deployment. Since the new virtual machine lacks the required tag, the Deny policy blocks its creation. However, Azure Policy does not retroactively delete or stop existing non-compliant resources, nor does it block operational state changes like starting an existing VM.

Step-by-Step Solution

1
Evaluate the deployment of the new virtual machine without the required tag.
The deployment request is intercepted by Azure Resource Manager and blocked.
The Azure Policy assignment has a 'Deny' effect for resources lacking the 'CostCenter' tag, which prevents the creation of any new non-compliant resources.
2
Evaluate the attempt to start the existing virtual machine.
The virtual machine starts successfully.
Azure Policy's 'Deny' effect does not retroactively block actions on existing resources, and starting an existing virtual machine is a state transition that does not change the resource definition evaluated by the deny policy.
3
Verify if the Owner RBAC role allows bypassing the policy.
The deployment remains blocked despite the Owner role.
Azure RBAC determines what actions a user can perform, whereas Azure Policy determines resource properties. RBAC permissions do not override Azure Policy evaluation.

Key Concept

Azure Policy evaluation timing, enforcement, and interaction with RBAC
Estimated Time:2m 0s
Rate this question

Topics

Azure Policy

More questions from this topic