Examkin

Question

Difficulty: Very hardAzure Policy Governance

VoltGrid Power operates a multi-region grid telemetry network in Azure. The resource hierarchy consists of a root management group named VoltGrid-Root, which contains two child management groups: VoltGrid-Americas and VoltGrid-Eurasia. Under VoltGrid-Americas, you have two subscriptions: Telemetry-Prod-Sub and Grid-Dev-Sub.

You need to design a governance strategy to enforce the following compliance requirements:
1. All Azure Virtual Machines deployed to Telemetry-Prod-Sub must have the Azure Monitor Agent (AMA) installed automatically upon deployment.
2. All Azure SQL Databases deployed within the VoltGrid-Americas management group must be blocked from creation if transparent data encryption (TDE) is not configured to use a customer-managed key (CMK).
3. The SQL Database TDE restriction must not apply to resources in a development resource group named Sandbox-RG located inside Grid-Dev-Sub.

The solution must minimize administrative overhead and avoid manual remediation processes.

Which two configurations should you include in your Azure Policy design?

  1. Assign a policy definition with the DeployIfNotExists effect to Telemetry-Prod-Sub to deploy the Azure Monitor Agent extension.Answer
  2. Assign a policy definition with the Deny effect to VoltGrid-Americas to restrict SQL Database TDE configuration, and configure the assignment's notScopes property to exclude Sandbox-RG.Answer
  3. C
    Assign a policy definition with the Audit effect to Telemetry-Prod-Sub to flag Virtual Machines missing the Azure Monitor Agent, and configure an Azure Logic App to run daily and install the extension.
  4. D
    Assign a policy definition with the Deny effect to VoltGrid-Americas to restrict SQL Database TDE configuration, and assign a policy definition with the Modify effect to Grid-Dev-Sub to set the TDE configuration to service-managed keys for Sandbox-RG.
  5. E
    Create a Policy Initiative containing both the VM agent installation and SQL TDE policy definitions, assign the initiative to VoltGrid-Root, and configure a Policy Exemption for Sandbox-RG.

Answer

Assign a policy definition with the DeployIfNotExists effect to Telemetry-Prod-Sub to deploy the Azure Monitor Agent, and assign a policy definition with the Deny effect to VoltGrid-Americas to restrict SQL Database TDE configuration while configuring the assignment's notScopes property to exclude Sandbox-RG.
To meet the compliance requirements with the least administrative effort, you should use the DeployIfNotExists effect to install the Azure Monitor Agent automatically on virtual machines. To block non-compliant databases across the entire Americas branch, the Deny policy must be applied at the VoltGrid-Americas management group scope. To exclude the specific development resources in Sandbox-RG from this block, you should use the notScopes (exclusion) property on the policy assignment. This keeps administrative overhead low and ensures that the policy rules are not evaluated within the sandbox scope.

Step-by-Step Solution

1
Analyze the automatic agent installation requirement.
Identify DeployIfNotExists as the correct effect for enforcing compliance by automatically deploying missing extensions.
DeployIfNotExists allows Azure Policy to deploy the Azure Monitor Agent extension dynamically if a Virtual Machine is created or updated without it, eliminating manual remediation.
2
Analyze the blocking requirement for SQL Databases without customer-managed keys.
Select the Deny effect at the VoltGrid-Americas management group scope.
The Deny effect prevents the creation of resources that do not match the specified compliance criteria, ensuring strict compliance across all child subscriptions.
3
Determine the optimal configuration for exempting the sandbox resource group.
Apply the notScopes property to the Deny policy assignment for Sandbox-RG.
The notScopes property prevents the policy from evaluating resources inside the specified resource group, allowing development resources to bypass the restrictions without modifying policy logic or affecting other subscriptions.

Key Concept

Azure Policy effects and assignment scope exclusions
Rate this question

Topics

Azure Policy Governance

More questions from this topic