Examkin

Question

Difficulty: EasyAzure Policy Governance

Your company is designing a governance strategy for Azure resources. You need to implement Azure Policies that satisfy the following requirements:
- Prevent the deployment of virtual machines that do not use approved VM sizes.
- Automatically add a default department tag to resource groups when they are created without one.

Which two Azure Policy effects should you select to meet these requirements?

  1. DenyAnswer
  2. ModifyAnswer
  3. C
    Audit
  4. D
    DeployIfNotExists

Answer

The correct effects to use are Deny to block non-compliant virtual machine deployments and Modify to automatically add missing tags to resource groups.
The correct strategy combines the Deny effect to block the creation of non-compliant resources (unapproved VM sizes) and the Modify effect to dynamically add missing tags during deployment.

Step-by-Step Solution

1
Analyze the first requirement: Prevent the deployment of virtual machines that do not use approved VM sizes.
To prevent or block a deployment that violates a compliance rule, the policy must use the Deny effect.
The Deny effect prevents a resource request from being sent to the resource provider, ensuring compliance is enforced proactively.
2
Analyze the second requirement: Automatically add a default department tag to resource groups when they are created without one.
To automatically add or update a property (like a tag) during resource creation, the policy must use the Modify effect.
The Modify effect allows the platform to inject properties or tags into the resource payload during deployment without blocking the deployment or requiring a separate deployment template.

Key Concept

Selecting appropriate Azure Policy effects to enforce compliance by blocking or automatically modifying resources during deployment.
Rate this question

Topics

Azure Policy Governance

More questions from this topic