Examkin

Question

Difficulty: HardAzure Policy Governance

An enterprise company has an Azure environment with a management group structure consisting of a root management group named Contoso-MG and a child management group named Workloads-MG. You are designing an Azure Policy strategy to satisfy the following compliance requirements:

1. All Azure Key Vaults deployed in any subscription under Contoso-MG must have diagnostic settings automatically enabled to route all audit logs to a central Log Analytics workspace.
2. All Azure Storage accounts deployed in any subscription under Workloads-MG must have public network access blocked. Any attempt by administrators to deploy a storage account with public network access enabled must be prevented.
3. The public network access restriction for storage accounts must not apply to a specific resource group named dev-public-rg in the App-Sub-01 subscription under Workloads-MG.

You need to design the governance solution to meet these requirements with the least administrative effort.

Which two Azure Policy configurations should you include in your design? (Select TWO.)

  1. An Azure Policy definition assigned to the Contoso-MG management group scope using the DeployIfNotExists effect to configure Key Vault diagnostic settings.Answer
  2. An Azure Policy definition assigned to the Workloads-MG management group scope using the Deny effect to block public network access on storage accounts, with the dev-public-rg resource group scope added to the notScopes property.Answer
  3. C
    An Azure Policy definition assigned to the Contoso-MG management group scope using the AuditIfNotExists effect to detect Key Vaults without diagnostic settings, combined with a daily Azure Automation runbook for remediation.
  4. D
    An Azure Policy definition assigned to the Workloads-MG management group scope using the Modify effect to disable public network access during storage account deployment, and a Policy Exemption assigned at the subscription level.

Answer

The correct configurations are: (1) assigning a policy definition using the DeployIfNotExists effect at the Contoso-MG management group scope to configure Key Vault diagnostic settings, and (2) assigning a policy definition using the Deny effect at the Workloads-MG management group scope to block public network access on storage accounts, with the dev-public-rg resource group added to the notScopes property.
The correct design uses the DeployIfNotExists effect to automatically configure diagnostic settings for Key Vaults at the root management group scope, ensuring all subscriptions inherit the policy. To block public network access on storage accounts, the Deny effect is used on the workloads management group scope. To exempt the development resource group from the deny policy, its scope is added to the notScopes property of the policy assignment, which provides the least administrative overhead.

Step-by-Step Solution

1
Analyze the log routing requirement for Azure Key Vaults.
Since diagnostic settings must be automatically enabled without manual intervention, a policy with the DeployIfNotExists effect is required. Assigning this at the parent Contoso-MG scope ensures inheritance across all child subscriptions.
DeployIfNotExists automatically runs a template deployment when a resource is created or updated and found to be non-compliant, avoiding administrative overhead.
2
Analyze the requirement to prevent public network access on storage accounts.
Since attempts to create storage accounts with public access enabled must be blocked, the Deny effect must be used. Assigning this to Workloads-MG covers the target subscriptions.
The Deny effect prevents requests that do not comply with the policy definition, satisfying the requirement to block deployments.
3
Evaluate the exemption requirement for the development resource group.
The dev-public-rg resource group must be excluded from the public network access block. This is achieved by adding the resource group's resource ID to the notScopes property of the policy assignment at the Workloads-MG scope.
Using notScopes excludes specific sub-scopes from the policy evaluation, minimizing administrative overhead compared to managing separate policies or broad exemptions.

Key Concept

Azure Policy effects (DeployIfNotExists, Deny) and assignment exclusions (notScopes) are used to enforce security governance and compliance across management groups and subscriptions while accommodating specific workload exemptions.
Estimated Time:3m 0s
Rate this question

Topics

Azure Policy Governance

More questions from this topic