Examkin

Question

Difficulty: HardAzure Policy Governance

A financial services firm designs an Azure Landing Zone. The Azure hierarchy contains a management group named Production-MG, which contains 15 subscriptions.

You need to design a governance solution for Azure Key Vault instances deployed across all subscriptions in Production-MG. The solution must meet the following requirements:
- Ensure all Key Vaults automatically send audit logs to a central Log Analytics workspace.
- Allow developers to provision Key Vaults immediately, even if they do not define diagnostic settings in their templates.
- Prevent compliance validation and logging for two specific subscriptions within Production-MG that host isolated sandboxes.
- Minimize administrative overhead.

Which of the following policy designs should you recommend?

  1. A policy definition with the DeployIfNotExists effect assigned to the Production-MG management group, with the two sandbox subscriptions specified in the notScopes property of the assignment.Answer
  2. B
    A policy definition with the Deny effect assigned to the Production-MG management group, with a policy exemption configured for the two sandbox subscriptions to allow manual auditing.
  3. C
    A policy definition with the Modify effect assigned to the Production-MG management group, with the two sandbox subscriptions specified in the notScopes property of the assignment.
  4. D
    A policy definition with the Audit effect assigned to each of the 13 compliant subscriptions individually, combined with an Azure Automation runbook triggered by Event Grid to configure diagnostic settings.

Answer

A policy definition with the DeployIfNotExists effect assigned to the Production-MG management group, with the two sandbox subscriptions specified in the notScopes property of the assignment.
The correct design uses the DeployIfNotExists effect, which evaluates compliance after a resource is created and automatically deploys the diagnostic settings child resource if it is missing. This prevents deployments from being blocked. Assigning the policy to the Production-MG management group with the two sandbox subscriptions in the notScopes exclusion property ensures governance across all required subscriptions with minimal administrative effort.

Step-by-Step Solution

1
Determine the required policy effect for automatic remediation and unblocked deployment.
The DeployIfNotExists effect is selected.
DeployIfNotExists allows resources to be deployed immediately and automatically remediates compliance by deploying missing child resources (diagnostic settings) afterwards. The Deny effect would block deployments, while the Modify effect is restricted to editing parent resource properties/tags.
2
Select the correct assignment scope and exemption strategy to minimize administrative overhead.
Assign the policy at the Production-MG management group level and specify the two sandbox subscriptions in the notScopes property.
Assigning at the management group level ensures policy inheritance across all 15 subscriptions. Using the notScopes property excludes the sandbox subscriptions from compliance evaluation at the assignment level, eliminating the need to manage 13 individual subscription-level assignments.

Key Concept

Azure Policy effects (DeployIfNotExists vs. Deny/Modify) and assignment scopes with inheritance exclusions (notScopes).
Rate this question

Topics

Azure Policy Governance

More questions from this topic