Examkin

Question

Difficulty: MediumAzure Policy Governance

A company named Kusto Corp has a multi-subscription Azure environment managed under a single management group named Kusto-Global. The company wants to enforce database security. Specifically, all Azure SQL databases in all subscriptions must have vulnerability assessment scanning enabled. If a SQL database is deployed without a vulnerability assessment configuration, the system must automatically deploy the configuration after the database is created, using a specific storage account for scan results. Additionally, the security team wants to exempt a subscription named Kusto-Sandbox, which is under Kusto-Global, from this compliance requirement. You need to design an Azure Policy solution that meets these requirements with the least administrative overhead. Which Azure Policy configuration should you recommend?

  1. Assign a policy using the DeployIfNotExists effect at the Kusto-Global management group scope, and configure the Kusto-Sandbox subscription as an exclusion (notScopes).Answer
  2. B
    Assign a policy using the Modify effect at the Kusto-Global management group scope, and manually configure the vulnerability assessment for each database in the Kusto-Sandbox subscription.
  3. C
    Assign a policy using the Deny effect at each subscription scope individually, and configure a policy exemption for the Kusto-Sandbox subscription.
  4. D
    Assign a policy using the Audit effect at the Kusto-Global management group scope, and configure an Azure Automation runbook to deploy the vulnerability assessment settings.

Answer

Assign a policy using the DeployIfNotExists effect at the Kusto-Global management group scope, and configure the Kusto-Sandbox subscription as an exclusion (notScopes).
The correct configuration uses the DeployIfNotExists effect because enabling vulnerability assessment requires deploying a nested resource (the settings and storage account target) if it does not already exist. Assigning the policy at the management group level with the sandbox subscription defined in the notScopes property ensures the policy inherits across all other subscriptions while exempting the sandbox, minimizing administrative overhead.

Step-by-Step Solution

1
Determine the required policy effect based on the remediation needs.
The requirement calls for automatic post-deployment configuration of vulnerability assessment settings when they are missing. This is a complex template deployment of a dependent resource rather than a simple property modification. Therefore, the DeployIfNotExists effect is required.
DeployIfNotExists allows automatic remediation of nested or dependent resources by deploying a templates-based configuration post-deployment.
2
Determine the assignment scope and exclusion model.
Assign the policy at the parent management group (Kusto-Global) and configure Kusto-Sandbox in the exclusion list (notScopes).
This leverages inheritance to apply the policy to all production subscriptions while exempting the sandbox subscription, minimizing administrative overhead.

Key Concept

Azure Policy effects and scope exclusion management in management group hierarchies.
Rate this question

Topics

Azure Policy Governance

More questions from this topic