Examkin

Question

Difficulty: MediumAzure Policy Governance

Novis Health has an Azure subscription hierarchy organized under a root management group named Novis-Root. Below Novis-Root, there are three management groups: Novis-Prod, Novis-Dev, and Novis-Shared. The company is designing a governance strategy for Azure Storage accounts. The strategy must meet the following compliance requirements:

* All storage accounts must restrict public network access.
* For resources in Novis-Prod, any attempt to deploy a storage account that allows public network access must be blocked.
* For resources in all other management groups under Novis-Root, storage accounts that allow public network access must be allowed to deploy but must be flagged as non-compliant in reports.

Which policy assignment strategy meets the requirements while minimizing administrative overhead?

  1. Assign the policy to Novis-Root with the effect set to Audit. Assign the same policy to Novis-Prod with the effect set to Deny.Answer
  2. B
    Assign the policy to Novis-Prod with the effect set to Deny. Assign the policy separately to Novis-Dev and Novis-Shared with the effect set to Audit.
  3. C
    Assign the policy to Novis-Root with the effect set to Deny, and add Novis-Dev and Novis-Shared to the exclusion list (notScopes) of the assignment.
  4. D
    Assign the policy to Novis-Root with the effect set to Deny, and create a policy exemption for Novis-Dev and Novis-Shared with the exemption category set to Waiver.

Answer

Assign the policy to Novis-Root with the effect set to Audit, and assign the same policy to Novis-Prod with the effect set to Deny.
The correct strategy leverages policy inheritance and Azure Policy evaluation behavior. Assigning the policy with the Audit effect at Novis-Root automatically applies it to all descendant scopes (Novis-Prod, Novis-Dev, and Novis-Shared), ensuring non-compliant storage accounts in Dev and Shared are flagged in compliance reports. Assigning the policy with the Deny effect specifically at Novis-Prod blocks non-compliant resource creation in the production scope. Since Deny is evaluated before Audit, any non-compliant deployment in Novis-Prod is blocked immediately, while other scopes remain audited. This approach achieves the requirements with only two assignments.

Step-by-Step Solution

1
Determine the required policy effects for each scope.
Novis-Prod requires blocking non-compliant resources (Deny effect). Other scopes require monitoring and reporting without blocking (Audit effect).
To match the compliance enforcement goals for production and non-production environments.
2
Analyze inheritance and assignment scopes to minimize overhead.
By assigning Audit at the root (Novis-Root), it inherits down to all child scopes. A separate Deny assignment at Novis-Prod overrides the behavior for production.
Inheritance reduces the number of assignments since any new management groups under the root will automatically be audited without additional assignments.
3
Evaluate exclusions and exemptions against reporting requirements.
Exclusions (notScopes) and policy exemptions completely bypass evaluation or mark resources as exempt. Neither option flags resources as non-compliant.
To ensure compliance reporting works as specified for non-production scopes.

Key Concept

Azure Policy assignment scopes, inheritance, and effect evaluation order.
Rate this question

Topics

Azure Policy Governance

More questions from this topic