Examkin

Question

Difficulty: EasyAzure Policy Governance

Your company requires that all new resource groups deployed to a production subscription must include a tag named 'CostCenter'. If an administrator attempts to create a resource group without this tag, Azure must immediately block the creation process. Which Azure Policy effect should you specify in the policy definition to meet this requirement?

  1. DenyAnswer
  2. B
    Audit
  3. C
    DeployIfNotExists
  4. D
    Modify

Answer

Deny
The correct answer is the option specifying the Deny effect. In Azure Policy, the Deny effect is designed to block any resource creation or update request that does not comply with the policy definition, ensuring immediate enforcement of compliance boundaries at the time of deployment.

Step-by-Step Solution

1
Analyze the compliance requirement.
The requirement states that resource creation must be immediately blocked if a specific tag ('CostCenter') is missing.
Understanding the desired action (blocking/prevention vs. monitoring or remediation) is key to selecting the correct Azure Policy effect.
2
Evaluate the capabilities of different Azure Policy effects.
The Deny effect prevents creation of non-compliant resources. The Audit effect only reports non-compliance. The DeployIfNotExists and Modify effects focus on remediation and alteration rather than blocking.
Comparing the policy effects determines which one aligns with the blocking requirement.
3
Select the policy effect that enforces the block.
The Deny effect is chosen because it directly blocks resource group creation when the 'CostCenter' tag is absent.
Deny is the only policy effect that prevents the deployment of non-compliant resources.

Key Concept

Azure Policy effects determine how Azure responds when a resource is evaluated against a policy rule. To prevent deployment of non-compliant resources, the Deny effect is used.
Rate this question

Topics

Azure Policy Governance

More questions from this topic