Examkin

Question

Difficulty: Very hardAzure Policy

An Azure resource group owner can successfully deploy a resource that violates a subscription-level Azure Policy with a 'Deny' effect, because Role-Based Access Control (RBAC) owner permissions override Azure Policy enforcement at the resource level.

Answer: Answer

Answer

False
The statement is false because Azure Policy is evaluated after Role-Based Access Control (RBAC). RBAC determines if a user has permission to perform an action, whereas Azure Policy ensures that the resource properties conform to defined rules. A policy with a 'Deny' effect will block any non-compliant deployment, even if initiated by a user with the Owner role.

Step-by-Step Solution

1
Analyze the relationship between Azure Role-Based Access Control (RBAC) and Azure Policy.
RBAC and Azure Policy are evaluated independently during resource deployment. RBAC checks if the user has permission to perform the action, while Azure Policy checks if the resource properties comply with corporate standards.
To determine whether permissions can bypass compliance rules.
2
Determine the sequence of evaluation during a deployment request.
The request is first authorized via RBAC. Once authorized, Azure Policy evaluates the resource properties against assigned policies before the resource provider processes the deployment.
To see if policy enforcement happens before or after RBAC checks are completed.
3
Evaluate the effect of a 'Deny' policy on an authorized user's deployment.
A 'Deny' policy blocks the creation or update of any resource that violates its rules, regardless of the user's RBAC role (including Owner). The deployment fails with a policy violation error.
To verify if the statement's claim that Owner permissions override the policy is correct.

Key Concept

Azure Policy is evaluated after RBAC permissions, and its enforcement cannot be bypassed by standard RBAC roles like Owner.
Rate this question

Topics

Azure Policy

More questions from this topic