Examkin

Question

Difficulty: MediumAzure Policy Governance

You are designing a governance strategy for a multi-subscription Azure environment. You have two management groups and subscriptions structured as follows:
- A management group named Production-MG contains two subscriptions: Subscription A and Subscription B.
- Subscription B contains a resource group named External-Connectivity-RG.

You need to implement Azure Policies to meet the following requirements:
1. Ensure all Azure Virtual Machines deployed in Subscription A automatically have the Azure Monitor Agent installed.
2. Prevent the deployment of public IP addresses in Subscription B, except within the External-Connectivity-RG resource group.

Which two policy configurations should you implement to meet the requirements with the least amount of administrative overhead? (Select TWO.)

  1. Assign a policy definition that deploys the Azure Monitor Agent using the DeployIfNotExists effect at the Subscription A scope.Answer
  2. Assign a policy definition that blocks public IP creation using the Deny effect at the Subscription B scope, and add the External-Connectivity-RG resource group to the assignment's exclusion (notScopes) list.Answer
  3. C
    Assign a policy definition that deploys the Azure Monitor Agent using the Deny effect at the Subscription A scope to block any VM deployments that do not include the agent.
  4. D
    Assign a policy definition that blocks public IP creation using the Audit effect at the Subscription B scope, and configure a scheduled task to manually delete public IPs outside of the External-Connectivity-RG resource group.

Answer

Assign a policy definition that deploys the Azure Monitor Agent using the DeployIfNotExists effect at the Subscription A scope, and assign a policy definition that blocks public IP creation using the Deny effect at the Subscription B scope, while adding the External-Connectivity-RG resource group to the assignment's exclusion (notScopes) list.
To satisfy the requirement to automatically install the Azure Monitor Agent, you must use the DeployIfNotExists effect, which triggers a remediation task. To prevent public IP deployment at the subscription level while exempting a specific resource group, assigning the Deny effect with a notScopes exclusion target is the most efficient design.

Step-by-Step Solution

1
Analyze Requirement 1: Automatically install the Azure Monitor Agent on VMs in Subscription A.
Identify that the DeployIfNotExists effect is the correct choice because it executes a template deployment to install the agent if it is missing from a newly created or updated VM resource.
DeployIfNotExists allows automatic remediation, whereas Deny would simply block the VM deployment and Audit would only report on compliance.
2
Analyze Requirement 2: Prevent the deployment of public IP addresses in Subscription B, with an exception for External-Connectivity-RG.
Identify that the Deny effect should be applied at the Subscription B scope to block public IP creation, and the External-Connectivity-RG resource group must be added to the notScopes parameter of the policy assignment to exclude it.
Deny stops the resource from being created, and using notScopes prevents the policy from being applied to that specific resource group, avoiding complex policy structures or duplicate assignments.

Key Concept

Azure Policy effects and assignment scope exclusions
Rate this question

Topics

Azure Policy Governance

More questions from this topic