Examkin

Question

Difficulty: EasyAzure Policy Governance

An organization wants to restrict the deployment of specific virtual machine sizes in a test resource group. If an administrator attempts to deploy a virtual machine with a size that is not on the allowed list, the deployment must be immediately blocked. Which Azure Policy effect should you recommend to meet this requirement?

  1. DenyAnswer
  2. B
    Audit
  3. C
    DeployIfNotExists
  4. D
    Modify

Answer

Deny
The correct option is Deny. The Deny effect is used to block resource requests that do not comply with the policy definition, preventing the deployment from succeeding in the first place.

Step-by-Step Solution

1
Analyze the compliance requirement to determine the desired outcome upon finding a non-compliant deployment attempt.
The requirement states that the deployment of unauthorized virtual machine sizes must be immediately blocked.
Identifying the enforcement action (blocking vs. auditing or remediating) is the key step to selecting the correct policy effect.
2
Evaluate the available Azure Policy effects against the blocking requirement.
The Deny effect prevents the creation or update of resources that do not match the policy definition, whereas Audit only logs the event, and DeployIfNotExists or Modify attempt remediation/alteration.
Selecting the policy effect that aligns with immediate prevention ensures cost controls are enforced at deployment time.

Key Concept

Azure Policy Effects for Compliance Enforcement
Estimated Time:45s
Rate this question

Topics

Azure Policy Governance

More questions from this topic