Examkin

Question

Difficulty: Very hardAzure Policy Governance

An enterprise uses a multi-tier Azure landing zone structure under a single Root Management Group (RMG). One of the child management groups is named Legacy-Workloads. The security compliance team requires that all Azure Storage accounts enforce double encryption (infrastructure encryption).

You must design a policy governance strategy to meet the following requirements:
* All new and updated storage accounts must have infrastructure encryption enabled. If not, the deployment must be prevented.
* Existing storage accounts that do not have infrastructure encryption enabled must be flagged as non-compliant for reporting, but their current configurations must remain unaltered, and no automatic remediation tasks should be executed.
* For subscriptions tagged with environment: sandbox, the infrastructure encryption requirement must be recommended but not enforced, ensuring that deployments can succeed even if non-compliant, while their compliance status continues to be monitored and reported.
* The policy must not apply to any resources within the Legacy-Workloads management group.
* The strategy must minimize administrative overhead by using the fewest policy definitions.

Which policy design strategy should you recommend?

  1. A
    Create a single policy definition with a parameterized effect. Assign the policy at the RMG level with the effect parameter set to Deny, adding only the Legacy-Workloads management group to the assignment's exclusion scope (notScopes). Assign the same policy at the sandbox subscription scopes with the effect parameter set to Audit, relying on local assignment inheritance to override the RMG-level assignment.
  2. B
    Create a policy definition with the DeployIfNotExists effect to automatically enable infrastructure encryption. Assign this policy at the RMG level with the Legacy-Workloads management group added to the exclusion scope (notScopes). Create a separate assignment of the policy with the AuditIfNotExists effect at the sandbox subscription scopes.
  3. Create a single policy definition with a parameterized effect. Assign the policy at the RMG level with the effect parameter set to Deny, adding the Legacy-Workloads management group and sandbox subscriptions to the assignment's exclusion scope (notScopes). Create a second assignment of the same policy at each sandbox subscription scope with the effect parameter set to Audit.Answer
  4. D
    Create a single policy definition with the Deny effect. Assign the policy at the RMG level, adding the Legacy-Workloads management group to the exclusion scope (notScopes). Create a Policy Exemption with a category of Waiver for each of the sandbox subscriptions to prevent the Deny effect from blocking deployments.

Answer

The correct strategy is to create a single policy definition with a parameterized effect, assign it at the Root Management Group level with the Deny effect (excluding both the Legacy-Workloads management group and the sandbox subscriptions), and assign the same policy definition at the sandbox subscriptions with the Audit effect.
The strategy of using a single policy definition with a parameterized effect, assigned at the Root Management Group level with Deny and excluding sandbox subscriptions, combined with a separate assignment set to Audit at the sandbox scope, is correct. Excluding the sandbox subscriptions from the Deny assignment ensures they are not blocked, while the child-level Audit assignment evaluates and reports compliance without blocking deployments. Excluding the Legacy-Workloads management group prevents any policy evaluation on its resources. Using a single definition minimizes administrative overhead.

Step-by-Step Solution

1
Determine the correct policy effect for blocking and monitoring without remediation.
The Deny effect blocks non-compliant resource deployments and flags existing non-compliant resources without altering them.
This satisfies the requirements to prevent new non-compliant resources while reporting existing ones without automatic remediation.
2
Determine how to handle the sandbox scopes.
The sandbox scopes require monitoring (Audit) but must not be blocked (Deny).
Since Azure Policy Deny assignments at a parent scope cannot be overridden by Audit assignments at a child scope, the sandbox scopes must be excluded from the parent Deny assignment using 'notScopes', and then targeted with a separate Audit assignment.
3
Determine how to handle the Legacy-Workloads management group.
The Legacy-Workloads management group must be excluded from the policy scope entirely.
Adding Legacy-Workloads to the 'notScopes' list of the RMG assignment ensures it is excluded.
4
Consolidate the policy definitions to minimize administrative overhead.
A single policy definition with a parameterized effect parameter can be assigned twice with different parameters (Deny and Audit).
This minimizes the number of custom policy definitions required, reducing administrative overhead.

Key Concept

Azure Policy effects evaluation, scope exclusions (notScopes), and parameterized assignments in a hierarchical landing zone.
Rate this question

Topics

Azure Policy Governance

More questions from this topic