Examkin

Question

Difficulty: HardAzure Policy

An administrator assigns an Azure Policy with the 'Modify' effect to remediate non-compliant resources within a resource group. To perform the remediation of these resources, Azure Policy executes the remediation tasks by using the security credentials of the administrator who assigned the policy. Is this statement true or false?

Answer: Answer

Answer

False
The correct answer is false because Azure Policy remediation tasks do not run under the security credentials of the administrator who assigned the policy; instead, they require a managed identity with the necessary RBAC permissions.

Step-by-Step Solution

1
Analyze how Azure Policy remediation works for effects like 'Modify' and 'DeployIfNotExists'.
Identify that these effects require a managed identity to perform remediation actions.
Remediation involves changing or creating Azure resources, which requires write permissions.
2
Determine the security context used to execute these remediation tasks.
Recognize that Azure Policy creates a managed identity (either system-assigned or user-assigned) and uses that identity's permissions.
Azure enforces security boundaries and does not impersonate the user credentials of the administrator.
3
Evaluate the statement in the prompt against these findings.
The statement claims the tasks are run using the security credentials of the administrator who assigned the policy, which is false.
This contradicts the security model of Azure Policy remediation which uses managed identities.

Key Concept

Azure Policy Remediation Security Context
Rate this question

Topics

Azure Policy

More questions from this topic