Examkin

Question

Difficulty: Very hardAzure Policy Governance

Aethera Genomics is designing an Azure governance model. The company's resource hierarchy consists of a root management group named Aethera-Root, under which exist two management groups named Aethera-Platform and Aethera-Workloads.

The Aethera-Platform management group hosts shared services, including a central Log Analytics workspace and private DNS resolvers at 10.100.1.410.100.1.4 and 10.100.1.510.100.1.5. The Aethera-Workloads management group contains three subscriptions: Aethera-Prod, Aethera-NonProd, and Aethera-Public-Ingress.

You need to design an Azure Policy strategy for the Aethera-Workloads management group that meets the following requirements:
1. All virtual networks (VNets) must automatically route DNS queries to the private DNS resolvers in Aethera-Platform upon creation, without blocking deployment.
2. All VNets must automatically stream resource logs to the central Log Analytics workspace in Aethera-Platform upon creation.
3. Creation of public IP addresses must be blocked across all subscriptions under Aethera-Workloads, except for the Aethera-Public-Ingress subscription, which requires public IPs for Application Gateways.

The solution must minimize administrative overhead.

Which two policy configurations should you include in the design?

  1. To enforce VNet DNS and logging, assign a policy initiative to the Aethera-Workloads management group containing a Modify policy to set VNet DNS settings and a DeployIfNotExists policy to deploy VNet diagnostic settings.Answer
  2. B
    To enforce VNet DNS and logging, assign a policy initiative to the Aethera-Workloads management group containing a Deny policy for VNets without custom DNS settings and a Deny policy for VNets without diagnostic settings.
  3. To restrict public IP creation, assign a policy with the Deny effect to the Aethera-Workloads management group, and exclude the Aethera-Public-Ingress subscription using the notScopes property of the policy assignment.Answer
  4. D
    To restrict public IP creation, assign a policy with the Audit effect to the Aethera-Workloads management group, configure manual scripts to delete new public IPs, and configure a policy exemption for the Aethera-Public-Ingress subscription.

Answer

To enforce virtual network DNS and diagnostic logging, assign a policy initiative to the workloads management group containing a Modify policy for VNet DNS settings and a DeployIfNotExists policy for VNet diagnostic settings. To restrict public IP creation, assign a policy with the Deny effect to the workloads management group, and exclude the ingress subscription using the notScopes property of the policy assignment.
To automatically configure custom DNS settings on virtual networks during deployment without blocking the creation, the Modify policy effect is required because it alters properties of the resource itself. To automatically stream resource logs, the DeployIfNotExists policy effect is required because diagnostic settings are deployed as a separate child resource. Grouping these policies into an initiative assigned at the workloads management group level reduces administrative overhead. Additionally, to block public IP creation while allowing it only within the ingress subscription, a policy with the Deny effect must be assigned at the workloads management group scope, with the ingress subscription specified in the notScopes parameter of the assignment to exclude it from enforcement.

Step-by-Step Solution

1
Determine the appropriate policy effect for virtual network DNS configuration.
Identify that custom DNS configuration modifies a property on the Virtual Network resource itself. To automatically apply this change without blocking creation, the Modify effect must be used.
Modify allows editing fields on the target resource during creation or update.
2
Determine the appropriate policy effect for enabling diagnostic logs on virtual networks.
Identify that diagnostic settings are distinct child resources (Microsoft.Insights/diagnosticSettings) rather than properties of the Virtual Network resource. To automatically deploy this child resource, the DeployIfNotExists effect is required.
DeployIfNotExists evaluates the existence of a child resource and deploys a template if the child resource is missing.
3
Identify the optimal policy assignment scope and grouping strategy.
Combine the Modify and DeployIfNotExists policies into a single policy initiative to simplify deployment, and assign it to the Aethera-Workloads management group level to leverage policy inheritance.
Grouping definitions into initiatives reduces assignment overhead and makes compliance monitoring easier.
4
Determine the correct block mechanism and exclusion strategy for public IP addresses.
Use the Deny effect to prevent creation of public IPs. Apply the policy at the workloads management group scope, and exclude the Aethera-Public-Ingress subscription by defining it under the notScopes parameter of the policy assignment.
Using notScopes at assignment time prevents the policy from evaluating resources in the ingress subscription, minimizing administrative overhead compared to managing lifecycle exemptions.

Key Concept

Azure Policy effects selection (Modify, DeployIfNotExists, Deny) and assignment exclusions (notScopes) to enforce resource compliance at scale.
Rate this question

Topics

Azure Policy Governance

More questions from this topic