Examkin

Question

Difficulty: MediumAzure Policy Governance

A retail company's cloud architecture includes a parent Management Group named Enterprise-MG that contains three subscriptions: Prod-Sub-01, Prod-Sub-02, and Dev-Sub-01. The governance team establishes the following design requirements:

- All virtual machines deployed in any subscription must use managed disks. Any attempt to deploy a virtual machine with unmanaged disks must be blocked.
- The development resource group Sandbox-RG, located in Dev-Sub-01, must be allowed to deploy virtual machines with unmanaged disks.
- All storage accounts deployed in any subscription must have diagnostic settings configured to send logs to a central Log Analytics workspace. If a storage account is deployed without diagnostic settings, the settings must be created automatically.

You need to design an Azure Policy solution that meets these requirements with the minimum administrative overhead.

Which two policy configurations should you include in the design?

  1. Assign a policy definition that uses the Deny effect to enforce managed disks at the Enterprise-MG level, and add the Sandbox-RG scope to the assignment's exclusion list (notScopes).Answer
  2. Assign a policy definition that uses the DeployIfNotExists effect to configure storage account diagnostics at the Enterprise-MG level, and configure a managed identity for remediation.Answer
  3. C
    Assign a policy definition that uses the Deny effect to block the creation of storage accounts without diagnostics at the Enterprise-MG level, and run a manual remediation task weekly.
  4. D
    Assign a policy definition that uses the Audit effect to flag virtual machines with unmanaged disks at the Enterprise-MG level, and write a custom automation runbook to delete non-compliant VMs.
  5. E
    Assign a policy definition that uses the Modify effect to convert unmanaged disks to managed disks during virtual machine deployment at the Enterprise-MG level.

Answer

Assigning a policy definition using the Deny effect to enforce managed disks at the Enterprise-MG level with Sandbox-RG excluded via notScopes, and assigning a policy definition using the DeployIfNotExists effect to configure storage diagnostics at the Enterprise-MG level with a managed identity.
Enforcing managed disks requires the Deny effect assigned at the parent management group level (Enterprise-MG) to ensure inheritance, with the Sandbox-RG resource group excluded via the notScopes parameter to allow unmanaged disks for development. Automatically configuring diagnostic settings for storage accounts requires the DeployIfNotExists (DINE) effect with a managed identity to perform remediation for resources that do not comply.

Step-by-Step Solution

1
Identify the mechanism to prevent the deployment of virtual machines with unmanaged disks across all subscriptions while allowing exceptions.
Determine that a policy definition using the Deny effect should be assigned at the parent management group level (Enterprise-MG) to ensure inheritance, with the Sandbox-RG resource group added to the assignment's 'notScopes' exclusion list to bypass the restriction.
This meets the security constraint at scale with the lowest administrative overhead by avoiding separate assignments per subscription.
2
Identify the mechanism to automatically configure storage account diagnostics when they are missing.
Determine that a policy definition using the DeployIfNotExists (DINE) effect should be assigned at the Enterprise-MG level, and a managed identity must be granted the necessary permissions to run the remediation task that deploys the diagnostic settings.
DeployIfNotExists checks for the existence of a child resource (diagnostic settings) and deploys it if it is missing, meeting the automation requirement.

Key Concept

Azure Policy effects and assignment scope exemptions
Rate this question

Topics

Azure Policy Governance

More questions from this topic