Examkin

Question

Difficulty: EasyAzure Policy

An organization needs to guarantee that all newly created storage accounts in their Azure subscription are restricted to a specific list of allowed locations. Which Azure service should be used to enforce this compliance requirement?

  1. Azure PolicyAnswer
  2. B
    Azure Role-Based Access Control (RBAC)
  3. C
    Resource Locks
  4. D
    Resource tags

Answer

Azure Policy
Azure Policy evaluates resources in Azure by comparing their properties to business rules defined in policy definitions. The built-in 'Allowed locations' policy definition can be assigned to a subscription or resource group to prevent the deployment of resources, such as storage accounts, in unauthorized regions.

Step-by-Step Solution

1
Identify the core goal of the requirement
The requirement is to enforce a resource properties constraint (allowed geographic locations) during resource creation.
This distinguishes it from identity permissions, deletion safety, or metadata tagging.
2
Select the governance service that evaluates resource configurations
Azure Policy analyzes resource properties against compliance definitions (like 'Allowed locations') and can deny non-compliant deployments.
This directly fulfills the requirement to prevent creation of out-of-region resources.

Key Concept

Azure Policy is used to enforce rules, standards, and compliance over Azure resources at creation or evaluation time.
Rate this question

Topics

Azure Policy

More questions from this topic