Examkin

Soru

Zorluk: ZorAzure Policy Definitions, Initiatives, and Assignments

An administrator configures the following Azure resource hierarchy:
* A management group named `Contoso-Org-MG`
* A subscription named `Sub-Procurement-01` under `Contoso-Org-MG`
* Two resource groups within `Sub-Procurement-01` named `rg-operational-prod` and `rg-testing-dev`

The administrator configures two Azure Policy assignments:
1. Assignment 1: Assigns a policy definition that denies the deployment of virtual machines unless they use the `Standard_D8s_v5` or `Standard_D16s_v5` SKU. This policy is assigned at the `Contoso-Org-MG` management group scope, with an exclusion configured for the `rg-testing-dev` resource group.
2. Assignment 2: Assigns a policy definition that denies the deployment of resources unless they contain a tag named `DeptCode`. This policy is assigned at the `Sub-Procurement-01` subscription scope, with no exclusions configured.

A developer attempts to perform the following actions:
* Action 1: Create a virtual machine using the `Standard_D8s_v5` SKU and a tag named `DeptCode` in the `rg-operational-prod` resource group.
* Action 2: Create a virtual machine using the `Standard_B2s` SKU and a tag named `DeptCode` in the `rg-testing-dev` resource group.
* Action 3: Create a virtual machine using the `Standard_D16s_v5` SKU and no tags in the `rg-operational-prod` resource group.
* Action 4: Create a virtual machine using the `Standard_B2s` SKU and no tags in the `rg-testing-dev` resource group.

Which of the actions will succeed? (Select two)

  1. Action 1Cevap
  2. Action 2Cevap
  3. C
    Action 3
  4. D
    Action 4

Cevap

The actions that will succeed are Action 1 and Action 2.
The actions that succeed are Action 1 and Action 2. In Action 1, the virtual machine meets both policy conditions (the SKU is permitted, and the DeptCode tag is present). In Action 2, the target resource group (rg-testing-dev) is excluded from the SKU restriction (Assignment 1), meaning the Standard_B2s SKU is allowed, and the deployment satisfies the tagging requirement (Assignment 2) by including the DeptCode tag.

Adım Adım Çözüm

1
Evaluate Action 1 against the active policy assignments for rg-operational-prod.
The target resource group rg-operational-prod inherits both Assignment 1 and Assignment 2. The virtual machine uses the allowed Standard_D8s_v5 SKU (satisfying Assignment 1) and contains the required DeptCode tag (satisfying Assignment 2). Action 1 succeeds.
To verify if the deployment succeeds, the resource must satisfy all policies applied to its scope and parent scopes.
2
Evaluate Action 2 against the active policy assignments for rg-testing-dev.
The target resource group rg-testing-dev is excluded from Assignment 1, meaning the SKU restriction does not apply. It still inherits Assignment 2, which requires the DeptCode tag. Since the tag is present, Action 2 succeeds.
Policy exclusions prevent the policy rules of a specific assignment from being evaluated against resources at that excluded scope.
3
Evaluate Action 3 against the active policy assignments for rg-operational-prod.
Although the SKU Standard_D16s_v5 is allowed under Assignment 1, the deployment fails because the virtual machine lacks the required DeptCode tag mandated by Assignment 2.
Azure Policies are cumulative; failing any single policy with a Deny effect blocks the entire resource deployment.
4
Evaluate Action 4 against the active policy assignments for rg-testing-dev.
Even though Assignment 1's SKU restriction is bypassed due to the exclusion, Assignment 2 still applies because there are no exclusions configured for Assignment 2. Since the resource lacks the DeptCode tag, Action 4 fails.
An exclusion on one policy assignment does not exempt the resource from other assignments targeting the same scope.

Anahtar Kavram

Azure Policy assignment inheritance, cumulative evaluation of Deny policies, and scope-specific exclusions.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Azure Policy Definitions, Initiatives, and Assignments