Examkin

Question

Difficulty: MediumAzure Policy Governance

Your company has an Azure environment with a management group hierarchy. You are designing a governance strategy to enforce the following compliance requirements:

1. All newly created or updated Azure Storage accounts must have 'Minimum TLS version' set to 'TLS 1.2'. If a storage account is deployed without this configuration, Azure must automatically configure it to TLS 1.2 during deployment.
2. Any attempt to deploy a Virtual Machine without a cost center tag named 'CostCenter' must be blocked.

You need to design the Azure Policy definitions to meet these requirements.

Which two policy effects should you recommend?

  1. ModifyAnswer
  2. DenyAnswer
  3. C
    DeployIfNotExists
  4. D
    Audit

Answer

The correct policy effects to recommend are Modify and Deny.
The Modify effect is the correct choice for the first requirement because it allows the policy engine to add or alter properties of the storage account (such as setting the minimum TLS version) during creation or update. The Deny effect is the correct choice for the second requirement because it actively blocks any resource deployment request that does not meet the specified condition (having the CostCenter tag), thereby preventing non-compliant virtual machines from being deployed.

Step-by-Step Solution

1
Analyze the first requirement: automatically configure 'Minimum TLS version' to 'TLS 1.2' during deployment for newly created or updated storage accounts.
Identify that this involves changing a configuration property on the primary resource itself during resource provisioning or updates.
The Modify effect is designed specifically to add or alter properties of a resource during creation or update. It also supports remediation of existing resources.
2
Analyze the second requirement: block any virtual machine deployment that does not have a cost center tag named 'CostCenter'.
Identify that this requires preventing the resource deployment from proceeding if compliance conditions are not met.
The Deny effect blocks the resource request before it reaches the resource provider, returning a failed deployment status to the user.
3
Evaluate the remaining options against the requirements to rule out inappropriate effects.
Determine that DeployIfNotExists is for deploying nested or auxiliary resources, and Audit does not block deployments.
Choosing the correct policy effects minimizes administrative overhead and ensures compliance rules are strictly enforced as required.

Key Concept

Azure Policy effects determine how resources are evaluated and governed. The Modify effect changes properties of resources during creation or update, while the Deny effect blocks non-compliant resource deployments. Correctly aligning policy effects to business requirements ensures compliance with minimum administrative overhead.
Rate this question

Topics

Azure Policy Governance

More questions from this topic