Examkin

Question

Difficulty: Very hardAzure Resources, Resource Groups, Subscriptions, and Management Groups

An organization implements an Azure governance structure. Under the root management group, they have a management group named Production-MG that contains a single subscription named Prod-Sub.

A cloud administrator performs the following actions in sequence:
1. Assigns an Azure Policy to Production-MG that denies the creation of any resource without a tag named Environment set to Production.
2. Creates a resource group named rg-services in Prod-Sub in the East US region, and applies the Environment: Production tag directly to the resource group.
3. Attempts to deploy a new virtual network in the West US region inside rg-services without adding any tags to the virtual network.
4. Attempts to create a new resource group named rg-data inside rg-services to isolate database resources.

Which of the following outcomes will occur?

  1. The virtual network deployment fails because resources do not inherit tags from their resource group, and the creation of the child resource group fails because resource groups cannot be nested.Answer
  2. B
    The virtual network deployment succeeds because it automatically inherits the tag from the resource group, but the creation of the child resource group fails because resource groups cannot be nested.
  3. C
    The virtual network deployment fails because resources must reside in the same region as their resource group, and the child resource group is successfully created inside the parent resource group.
  4. D
    The virtual network deployment succeeds because parent management group policies do not apply to individual resources inside a resource group, and the child resource group is successfully created inside the parent resource group.

Answer

The virtual network deployment fails because resources do not inherit tags from their resource group, and the creation of the child resource group fails because resource groups cannot be nested.
The correct option identifies that the virtual network deployment fails because resources do not automatically inherit tags from their resource groups, meaning the deployment violates the policy applied at the management group. Furthermore, resource groups cannot be nested, so the attempt to create a child resource group inside an existing one fails.

Step-by-Step Solution

1
Analyze Azure Policy inheritance from Management Groups.
Policies applied to a management group are inherited by all subscriptions under it, and consequently, apply to all resources created within those subscriptions.
Governance controls like Azure Policy propagate down the management hierarchy.
2
Analyze resource tag inheritance behavior.
Tags applied to a resource group are not inherited by the resources inside that resource group.
Azure resources do not automatically copy or inherit tags from their parent resource groups.
3
Evaluate the virtual network deployment against the policy.
The virtual network deployment is blocked/denied because it has no tags, violating the inherited policy requiring the Environment: Production tag.
The policy requires the tag on all resources, and since the virtual network did not have the tag applied and does not inherit it, the creation is denied.
4
Evaluate resource group nesting capabilities.
The creation of rg-data inside rg-services fails.
Azure does not support nesting resource groups under other resource groups.

Key Concept

Azure Policy inheritance, resource group nesting rules, tag inheritance behavior, and resource region independence.
Rate this question

Topics

Azure Resources, Resource Groups, Subscriptions, and Management Groups