Examkin

Question

Difficulty: HardAzure Policy Governance

An organization is designing a governance and compliance strategy for its Azure landing zones. The resource hierarchy consists of a parent Management Group named MG-LandingZones, which contains three subscriptions: Sub-App1, Sub-App2, and Sub-Shared.

You need to design an Azure Policy strategy that meets the following requirements:
1. All Azure Key Vaults deployed within MG-LandingZones must have diagnostic settings configured to send logs to a central Log Analytics workspace. If a Key Vault is deployed without these settings, they must be automatically created without blocking the deployment of the Key Vault itself.
2. Virtual machines deployed in the Sub-Shared subscription must be prevented from using public IP addresses. However, virtual machines deployed in a specific resource group named RG-Edge-Inbound within Sub-Shared must be allowed to have public IP addresses.

Which two Azure Policy configurations should you recommend to meet these requirements?

  1. Assign an Azure Policy definition with the DeployIfNotExists effect at the MG-LandingZones management group to deploy diagnostic settings on Key Vaults.Answer
  2. Assign an Azure Policy definition with the Deny effect at the Sub-Shared subscription to block virtual machines with public IP addresses, and configure the RG-Edge-Inbound resource group in the notScopes property of the assignment.Answer
  3. C
    Assign an Azure Policy definition with the Deny effect at the MG-LandingZones management group to block the creation of Key Vaults if diagnostic settings are not defined in the deployment request.
  4. D
    Assign an Azure Policy definition with the Modify effect at the Sub-Shared subscription to remove public IP address configurations from virtual machines during deployment, and apply a policy exemption to the RG-Edge-Inbound resource group.

Answer

Assign an Azure Policy definition with the DeployIfNotExists effect at the MG-LandingZones management group to deploy diagnostic settings on Key Vaults, and assign an Azure Policy definition with the Deny effect at the Sub-Shared subscription to block virtual machines with public IP addresses while excluding the RG-Edge-Inbound resource group using the notScopes property of the assignment.
To satisfy the first requirement, the DeployIfNotExists effect is the correct choice because it allows the Key Vault to be created and then automatically deploys the diagnostic settings if they do not exist. To satisfy the second requirement, the Deny effect is used to block deployments containing public IPs, and the notScopes (exclusion) property of the policy assignment is used to exempt the RG-Edge-Inbound resource group from the policy scope, thus allowing deployments with public IPs only within that group.

Step-by-Step Solution

1
Analyze the first requirement regarding Azure Key Vault diagnostics and automatic remediation without blocking deployment.
Identify that automatic remediation of missing child resources (like diagnostic settings) without blocking the parent deployment is best handled by the DeployIfNotExists (DINE) effect.
The DeployIfNotExists effect evaluates resources and deploys a template to create the missing settings if compliance is not met, aligning perfectly with the requirement.
2
Analyze the second requirement to prevent public IP usage on VMs in a subscription while exempting a specific resource group.
Identify that blocking resource creation requires the Deny effect, and excluding a specific scope from a policy assignment is best handled using the notScopes property.
Assigning a Deny policy at the subscription level with the notScopes exclusion ensures that any VM deployment with a public IP is blocked everywhere except in the specified resource group.

Key Concept

Azure Policy Governance and Effects
Estimated Time:2m 0s
Rate this question

Topics

Azure Policy Governance

More questions from this topic