Examkin

Question

Difficulty: MediumAzure Policy

An organization needs to restrict resource deployment in a subscription so that only members of the 'Finance Admin' group can create new resources. Is Azure Policy the primary tool used to enforce this identity-based access control requirement?

Answer: Answer

Answer

False
The correct answer is False because restricting deployments based on user identity or group membership is the responsibility of Azure Role-Based Access Control (RBAC), not Azure Policy. Azure Policy is used to enforce rules regarding resource properties and configurations, such as allowing only specific VM sizes or requiring resource tags.

Step-by-Step Solution

1
Identify the core requirement in the scenario.
The requirement is to restrict resource deployment to a specific user group ('Finance Admin').
This establishes that the control is identity-based rather than resource-property-based.
2
Differentiate between Azure Policy and Azure Role-Based Access Control (RBAC).
Azure RBAC manages authorization (who can do what), while Azure Policy manages resource properties (what compliance standards resources must meet).
Understanding the distinct roles of governance tools allows for the correct tool selection.
3
Determine the correct answer based on the evaluation.
Since the restriction is identity-based, RBAC is the correct tool, making the statement that Azure Policy is the primary tool false.
This matches the scenario's constraint with the appropriate Azure governance service.

Key Concept

Azure Policy vs. Azure Role-Based Access Control (RBAC)
Rate this question

Topics

Azure Policy

More questions from this topic