Examkin

Question

Difficulty: MediumAzure Policy Governance

A financial enterprise manages its Azure resources across multiple production subscriptions using a root management group named Finance-Root. The compliance team mandates that all Azure storage accounts must enforce secure transfer (HTTPS traffic only). If a developer attempts to deploy a storage account with secure transfer disabled, the deployment must succeed, but Azure Policy must automatically enable secure transfer during resource creation. You need to design a governance solution that enforces this requirement with the least administrative effort. Which Azure Policy design should you recommend?

  1. A
    An Azure Policy definition with the Deny effect assigned at the individual subscription level.
  2. An Azure Policy definition with the Modify effect assigned at the management group level.Answer
  3. C
    An Azure Policy definition with the DeployIfNotExists effect assigned at the management group level.
  4. D
    An Azure Policy definition with the Audit effect assigned at the resource group level, combined with a scheduled automation runbook.

Answer

An Azure Policy definition with the Modify effect assigned at the management group level.
The Modify effect allows Azure Policy to add or update properties of a resource during creation or update, enabling automatic remediation without blocking the deployment. Assigning it at the management group level applies the policy hierarchy-wide, minimizing administrative overhead.

Step-by-Step Solution

1
Analyze compliance requirements and the target action.
The requirement is to automatically change a property (enable secure transfer) during resource deployment without blocking it.
Determines the appropriate Azure Policy effect.
2
Compare the applicable Azure Policy effects (Deny, DeployIfNotExists, and Modify).
The Modify effect is suited for changing resource properties during creation, whereas Deny blocks creation, and DeployIfNotExists deploys secondary resources.
Identifies that Modify is the correct effect for in-flight property changes.
3
Determine the optimal scope for the policy assignment.
Assigning the policy at the management group level automatically applies it to all underlying subscriptions, minimizing governance overhead.
Aligns the design with Azure governance best practices.

Key Concept

Using the Modify policy effect to alter resource properties during creation and assigning policies at the management group level to scale governance.
Rate this question

Topics

Azure Policy Governance

More questions from this topic