Examkin

Question

Difficulty: Very hardAzure Policy Governance

Your organization, Contoso Global Investments, uses an Azure Management Group hierarchy consisting of a Root Management Group (Root-MG), under which sit the Core-Services Management Group (Core-MG) and the Business-Line Management Group (Business-MG). Under Business-MG, you have two child management groups: Production (Prod-MG) and Development (Dev-MG). You need to design an Azure Policy governance strategy to meet the following compliance requirements:

1. All Azure Storage Accounts deployed within Business-MG and its descendants must only allow HTTPS traffic. Any deployment attempt of a storage account that allows HTTP traffic must be blocked.
2. All virtual machines deployed in Prod-MG must be configured for Azure Backup. If a virtual machine is deployed without a backup configuration, Azure must automatically deploy the backup association after the virtual machine is successfully created, without blocking the deployment itself.
3. To control costs, G-series virtual machines must be prohibited from being deployed anywhere under Root-MG, except for a single subscription named HPC-Prod-Sub under Prod-MG, which hosts a specialized risk analysis engine.

Which set of Azure Policy assignments and effects should you recommend to meet these requirements while minimizing administrative overhead?

  1. 1. Assign a policy with the Deny effect for storage account HTTPS enforcement at the Business-MG scope. 2. Assign a policy with the DeployIfNotExists effect for VM Backup at the Prod-MG scope. 3. Assign a policy with the Deny effect for G-series VMs at the Root-MG scope, with HPC-Prod-Sub specified in the notScopes assignment property.Answer
  2. B
    1. Assign a policy with the Deny effect for storage account HTTPS enforcement at the Business-MG scope. 2. Assign a policy with the Deny effect for VM Backup at the Prod-MG scope. 3. Assign a policy with the Deny effect for G-series VMs at the Root-MG scope, with HPC-Prod-Sub specified in the notScopes assignment property.
  3. C
    1. Assign a policy with the Modify effect for storage account HTTPS enforcement at the Business-MG scope. 2. Assign a policy with the DeployIfNotExists effect for VM Backup at the Prod-MG scope. 3. Assign a policy with the Deny effect for G-series VMs at the Core-MG, Prod-MG, and Dev-MG scopes individually, omitting HPC-Prod-Sub.
  4. D
    1. Assign a policy with the Deny effect for storage account HTTPS enforcement at the Business-MG scope. 2. Assign a policy with the DeployIfNotExists effect for VM Backup at the Prod-MG scope. 3. Assign a policy with the Deny effect for G-series VMs at the Root-MG scope, and write a custom automation runbook to delete G-series VMs in HPC-Prod-Sub.

Answer

Assign a policy with the Deny effect for storage account HTTPS at the Business-MG scope; assign a policy with the DeployIfNotExists effect for VM Backup at the Prod-MG scope; and assign a policy with the Deny effect for G-series VMs at the Root-MG scope with HPC-Prod-Sub in the notScopes property.
The correct recommendation uses the Deny effect at Business-MG for storage account HTTPS enforcement because the requirement mandates blocking non-compliant deployments. It uses the DeployIfNotExists effect at Prod-MG for VM Backup because it allows the VM to be deployed first and then automatically configures backup post-deployment without blocking creation. Lastly, it assigns the G-series restriction at the Root-MG level and excludes HPC-Prod-Sub using the notScopes property. This strategy enforces the restriction globally while allowing the exception with a single assignment, representing the lowest possible administrative overhead.

Step-by-Step Solution

1
Determine the policy effect for the storage account HTTPS enforcement requirement.
Since any deployment attempt of a storage account that allows HTTP traffic must be blocked, the Deny effect must be used. Assigning it at the Business-MG scope ensures it applies to Business-MG and all child groups (Prod-MG and Dev-MG).
The Deny effect blocks the resource deployment if the evaluated properties match the non-compliant conditions.
2
Determine the policy effect for the VM Backup configuration requirement.
Since non-compliant virtual machines must be remediated after deployment without blocking the VM deployment itself, the DeployIfNotExists (DINE) effect must be used at the Prod-MG scope.
DeployIfNotExists allows a deployment template to run when the target resource is created, making it suitable for deploying auxiliary resources like backup associations after the parent resource is created successfully.
3
Determine the assignment scope and exclusion mechanism for the VM SKU restriction.
To prohibit G-series VMs across all management groups except HPC-Prod-Sub with the least administrative overhead, assign a Deny policy at Root-MG and add the resource ID of HPC-Prod-Sub to the notScopes property of the assignment.
Using the notScopes property during assignment at a higher scope avoids the need to assign policies individually to each child management group, reducing management overhead and ensuring automatic inheritance for new management groups.

Key Concept

Azure Policy effects and assignment scope exclusions
Rate this question

Topics

Azure Policy Governance

More questions from this topic