Examkin

Question

Difficulty: MediumAzure Policy Governance

A company named Solis Energy is designing a governance strategy for its Azure subscriptions. The subscriptions are organized under a parent management group named Solis-Production.

The company has the following requirements:
1. All newly deployed virtual machines must have the Azure Monitor Dependency Agent installed automatically.
2. Virtual machines deployed in a specific subscription named Solis-DevTest, which is nested under Solis-Production, must not have the agent installed to minimize costs.
3. The solution must minimize administrative overhead.

Which Azure Policy design should you recommend?

  1. Assign an Azure Policy containing a DeployIfNotExists effect at the Solis-Production management group scope, and configure the Solis-DevTest subscription in the notScopes property of the assignment.Answer
  2. B
    Assign an Azure Policy containing a Deny effect at the Solis-Production management group scope, and configure the Solis-DevTest subscription in the notScopes property of the assignment, then manually install the agent.
  3. C
    Assign an Azure Policy containing a Modify effect at the Solis-Production management group scope, and assign a separate policy with the Audit effect to the Solis-DevTest subscription to overwrite the parent setting.
  4. D
    Assign an Azure Policy containing an Audit effect at the Solis-Production management group scope, and manually deploy the agent to non-compliant virtual machines using an Azure Automation runbook.

Answer

Assign an Azure Policy containing a DeployIfNotExists effect at the Solis-Production management group scope, and configure the Solis-DevTest subscription in the notScopes property of the assignment.
The DeployIfNotExists effect is designed to deploy a template (such as a VM extension) if it does not exist when a resource is created or updated. Assigning the policy at the management group level ensures inheritance across all nested subscriptions. Using the notScopes property in the assignment is the standard method to exclude specific scopes (like the Solis-DevTest subscription) from the policy's effect without needing to manage multiple separate assignments, thereby minimizing administrative overhead.

Step-by-Step Solution

1
Identify the policy effect that can automatically deploy resources or extensions.
The DeployIfNotExists effect is selected because it enables automatic deployment of the Dependency Agent extension when a virtual machine is created or updated.
To satisfy the requirement of automatic installation of the agent without blocking VM deployment.
2
Determine the optimal scope and exclusion mechanism.
Assign the policy at the Solis-Production management group scope and list the Solis-DevTest subscription in the notScopes (exclusions) property of the assignment.
To apply the policy to all subscriptions under the management group while cleanly excluding the DevTest subscription with minimal administrative overhead.

Key Concept

Azure Policy effects and assignment scope exclusions
Rate this question

Topics

Azure Policy Governance

More questions from this topic