Examkin

Question

Difficulty: Very hardAzure Resources, Resource Groups, Subscriptions, and Management Groups

An organization has an Azure environment with a Management Group hierarchy where a parent Management Group named Corp-MG contains two subscriptions: Sub-Prod and Sub-Dev.

An administrator must design a deployment for a new application. The deployment must meet the following requirements:
1. The application's database and web server resources must be managed together as a single lifecycle unit.
2. The database must be physically located in the West US region, and the web server must be physically located in the East US region.
3. A security compliance policy must be applied at a level that automatically enforces compliance across both the Sub-Prod and Sub-Dev subscriptions.

Which configuration should the administrator implement to meet these requirements?

  1. A
    Apply the security policy at the Sub-Prod subscription level. Create a single resource group in Sub-Prod, and deploy both the database and the web server to the East US region.
  2. Apply the security policy at the Corp-MG level. Create a single resource group in the Sub-Prod subscription, and deploy the web server to East US and the database to West US within that resource group.Answer
  3. C
    Apply the security policy at the Corp-MG level. Create a parent resource group in East US for the web server, and nest a child resource group in West US for the database inside it.
  4. D
    Apply the security policy at the Corp-MG level. Create one resource group in East US for the web server and a separate resource group in West US for the database, because resources must reside in a resource group located in the same region.

Answer

Apply the security policy at the Corp-MG level. Create a single resource group in the Sub-Prod subscription, and deploy the web server to East US and the database to West US within that resource group.
The correct configuration applies the security compliance policy at the Corp-MG level, ensuring that both Sub-Prod and Sub-Dev inherit the policy. It then uses a single resource group within the Sub-Prod subscription to group the resources for lifecycle management. Since Azure allows resources to reside in different regions than their parent resource group, the web server can be deployed in East US and the database in West US within the same resource group.

Step-by-Step Solution

1
Determine the correct scope for the security policy.
The security policy must be applied at the management group (Corp-MG) level.
Applying a policy at a management group ensures that all subscriptions underneath it (both Sub-Prod and Sub-Dev) automatically inherit and enforce the policy.
2
Determine the resource group configuration to manage the application resources as a single lifecycle unit.
All resources (web server and database) must be deployed into a single resource group.
A resource group serves as a logical container for resources that share the same lifecycle. Resources cannot be nested, so they must reside in the same group to be managed together.
3
Determine the region configuration for the resources within the resource group.
Deploy the web server to East US and the database to West US within the single resource group.
An Azure resource group is a logical container and can hold resources located in different geographical regions. The location of the resource group itself only specifies where its metadata is stored, not where the resources inside it must be deployed.

Key Concept

Azure resource hierarchy, inheritance of policies from management groups, and the decoupled relationship between resource locations and resource group locations.
Estimated Time:3m 0s
Rate this question

Topics

Azure Resources, Resource Groups, Subscriptions, and Management Groups