Examkin

Question

Difficulty: HardAzure Policy Governance

A financial services company is designing the governance strategy for its Azure landing zone. The management group hierarchy has a root management group named Enterprise-MG, with two child management groups: Production-MG and Sandbox-MG. You need to implement a policy governance strategy that satisfies the following requirements:

1. All Azure Key Vaults deployed within Production-MG must automatically have diagnostic logging configured to send logs to a central Log Analytics workspace upon resource creation.
2. No virtual machines within Enterprise-MG are allowed to have public IP addresses, and any deployment attempt that includes a public IP must be blocked. However, this restriction must not apply to resources within a specific subscription under Sandbox-MG named Dev-Sandbox-Sub.

Which policy configuration should you design to meet these requirements with the minimum administrative overhead?

  1. A
    Assign a Deny policy for Key Vault diagnostics to Production-MG, and assign a Deny policy for public IPs to Enterprise-MG with the subscription ID of Dev-Sandbox-Sub added to the notScopes property of the assignment.
  2. B
    Assign a DeployIfNotExists policy for Key Vault diagnostics to Production-MG, and assign a DeployIfNotExists policy for public IPs to Enterprise-MG to automatically strip public IP addresses, without configuring any exclusions.
  3. Assign a DeployIfNotExists policy for Key Vault diagnostics to Production-MG, and assign a Deny policy for public IPs to Enterprise-MG with the subscription ID of Dev-Sandbox-Sub added to the notScopes property of the assignment.Answer
  4. D
    Assign a Deny policy for Key Vault diagnostics to Production-MG, and assign a DeployIfNotExists policy for public IPs to Enterprise-MG with the subscription ID of Dev-Sandbox-Sub added to the notScopes property of the assignment.

Answer

Assign a DeployIfNotExists policy for Key Vault diagnostics to Production-MG, and assign a Deny policy for public IPs to Enterprise-MG with the subscription ID of Dev-Sandbox-Sub added to the notScopes property of the assignment.
The correct strategy uses the DeployIfNotExists effect to automatically configure diagnostic settings for new Key Vaults in the production management group, and the Deny effect at the parent management group to block public IP configurations. The notScopes property of the Deny policy assignment is used to exclude the specific sandbox subscription from this restriction, minimizing management overhead.

Step-by-Step Solution

1
Determine the appropriate policy effect for automatic log configuration.
DeployIfNotExists (DINE) is selected because the requirement is to automatically deploy diagnostic settings for newly created resources without blocking the deployment.
DeployIfNotExists allows automatic remediation of resources that do not comply with the desired state at the time of creation or update.
2
Determine the appropriate policy effect to block resources with public IPs.
Deny is selected because the requirement is to block any deployment attempts that include a public IP.
The Deny effect prevents resource creation or modification requests that violate the defined policy rules.
3
Identify the scoping and exclusion strategy to minimize administrative overhead.
Assign the Deny policy at the Enterprise-MG root scope and add the Dev-Sandbox-Sub subscription to the notScopes property of the assignment. Assign the DeployIfNotExists policy at the Production-MG child scope.
Using notScopes on a single policy assignment at a higher management group level avoids the overhead of managing multiple individual policy assignments or exemptions.

Key Concept

Azure Policy effects and assignment scope exclusions
Estimated Time:2m 0s
Rate this question

Topics

Azure Policy Governance

More questions from this topic