Examkin

Question

Difficulty: MediumAzure Policy Governance

An enterprise organizes its Azure subscriptions under a management group hierarchy. Under the root management group, there is a production management group named `MG-Prod`. You are designing a governance strategy to enforce security standards on Azure Storage accounts deployed under `MG-Prod` with the following requirements:
- If a storage account is deployed with secure transfer (HTTPS) disabled, it must be automatically configured to enable secure transfer during deployment.
- If a storage account is deployed with public blob access enabled, the deployment must be blocked.
- A resource group named `RG-Legacy-Shares` under a production subscription must be allowed to deploy storage accounts with public blob access enabled, but must still have secure transfer enforced.

Which policy design should you recommend?

  1. Assign a policy that uses the `Modify` effect to enable secure transfer on storage accounts to `MG-Prod`. Assign a second policy that uses the `Deny` effect to block public blob access to `MG-Prod`, and add `RG-Legacy-Shares` to the `notScopes` property of the second policy's assignment.Answer
  2. B
    Assign a policy that uses the `DeployIfNotExists` effect to enable secure transfer on storage accounts to `MG-Prod`. Assign a second policy that uses the `Deny` effect to block public blob access to `MG-Prod`, and add `RG-Legacy-Shares` to the `notScopes` property of both assignments.
  3. C
    Group both policies into a single policy initiative. Assign the initiative to `MG-Prod`, and add `RG-Legacy-Shares` to the `notScopes` property of the initiative assignment.
  4. D
    Assign a policy that uses the `Modify` effect to enable secure transfer on storage accounts to `MG-Prod`. Assign a second policy that uses the `Audit` effect to monitor public blob access to `MG-Prod`, and configure an Azure Automation runbook to delete public storage accounts unless they are in `RG-Legacy-Shares`.

Answer

Assign a policy that uses the `Modify` effect to enable secure transfer on storage accounts to `MG-Prod`. Assign a second policy that uses the `Deny` effect to block public blob access to `MG-Prod`, and add `RG-Legacy-Shares` to the `notScopes` property of the second policy's assignment.
The correct design uses the `Modify` effect for the secure transfer policy to automatically remediate resource properties during deployment, and uses the `Deny` effect to block the deployment of any storage accounts with public blob access enabled. Because the legacy resource group must be exempt from the public access restriction but still subject to the secure transfer policy, the policies must be assigned as separate assignments. This allows the legacy resource group to be specified in the `notScopes` parameter of the public blob access policy assignment only, keeping the secure transfer rule fully active on that scope.

Step-by-Step Solution

1
Determine the appropriate policy effect for secure transfer auto-remediation.
Identify that the `Modify` effect is designed to add, update, or remove properties during resource creation or update, making it ideal for enforcing secure transfer (`supportsHttpsTrafficOnly = true`) on storage accounts without rejecting deployments.
This satisfies the requirement to automatically configure secure transfer during deployment with minimal overhead.
2
Determine the appropriate policy effect to prevent public blob access.
Identify that the `Deny` effect blocks the creation of resources that do not comply with the policy rules.
This satisfies the requirement to prevent and block the deployment of storage accounts that have public blob access enabled.
3
Determine how to handle scope exclusions for the legacy resource group.
Determine that since `RG-Legacy-Shares` only needs to be excluded from the public access block (but still have secure transfer enforced), the policies must be assigned separately rather than as a single initiative. The `notScopes` parameter of the public blob access policy assignment must target `RG-Legacy-Shares`.
This ensures the exclusion is applied granularly only to the public blob access rule, satisfying all constraints.

Key Concept

Azure Policy effects and assignment scope exclusions
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Governance

More questions from this topic