Examkin

Soru

Zorluk: Çok zorAzure Policy Definitions, Initiatives, and Assignments

Your organization uses the following Azure resource hierarchy:
* A Management Group named Corp-MG.
* Two subscriptions under Corp-MG named Prod-Sub and Dev-Sub.
* Prod-Sub contains two resource groups: RG-Core and RG-Data.
* Dev-Sub contains a resource group named RG-Dev.

The following Azure Policy configurations are in place:

ScopeAssignment / Policy DetailEffectAllowed/Required ValuesExclusions
Corp-MGInitiative Gov-Initiative containing:
- VM SKU restriction policy
- Resource tag enforcement policy		Deny
Deny
- Standard_D2s_v3, Standard_D4s_v3
- Tag Environment must exist		None
Prod-SubPolicy Region-RestrictionDenyEast US, West USRG-Data

You need to identify which resource deployment attempts will succeed.

Which two deployment attempts will complete successfully? (Select two.)

  1. A Standard_D2s_v3 virtual machine deployed to RG-Data in North Europe with the tag Environment set to Production.Cevap
  2. A Standard_D4s_v3 virtual machine deployed to RG-Core in East US with the tag Environment set to Production.Cevap
  3. C
    A Standard_D2s_v3 virtual machine deployed to RG-Core in North Europe with the tag Environment set to Production.
  4. D
    A Standard_B2s virtual machine deployed to RG-Data in West US with the tag Environment set to Production.
  5. E
    A Standard_D4s_v3 virtual machine deployed to RG-Dev in West US without any tags.

Cevap

The two successful deployments are: (1) A Standard_D2s_v3 virtual machine deployed to RG-Data in North Europe with the tag Environment set to Production, and (2) A Standard_D4s_v3 virtual machine deployed to RG-Core in East US with the tag Environment set to Production.
The correct deployments are those that satisfy the management group VM SKU and tag requirements, while also respecting the subscription region limits or qualifying for their exclusions. Specifically, the Standard_D2s_v3 VM deployed to RG-Data in North Europe with the Environment tag succeeds because the VM SKU and tags are valid, and RG-Data is excluded from the region restrictions. The Standard_D4s_v3 VM in RG-Core (East US) succeeds because its SKU, region, and tags are all within the allowed limits.

Adım Adım Çözüm

1
Evaluate the management group (Corp-MG) policy constraints for all deployment attempts.
The Corp-MG level policy requires the VM SKU to be either Standard_D2s_v3 or Standard_D4s_v3, and requires the Environment tag to be present. This blocks the attempt using Standard_B2s and the attempt without any tags.
Since both subscriptions inherit from Corp-MG, all resources under them must comply with these policies.
2
Evaluate the subscription-level (Prod-Sub) region-restriction policy for the remaining attempts.
The subscription policy restricts deployments to East US and West US, but excludes RG-Data. Therefore, a VM deployed in RG-Core must be in East US or West US, whereas a VM deployed in RG-Data can be in any region (such as North Europe).
Policy exclusions exempt the specified scopes from the policy assignment's evaluation rules.
3
Verify which deployments satisfy all applicable inherited and scope-specific policies.
The Standard_D2s_v3 VM in RG-Data (North Europe) succeeds due to the exclusion. The Standard_D4s_v3 VM in RG-Core (East US) succeeds because it complies with the region rule and all other inherited rules.
Only deployments that do not trigger a 'Deny' action from any active policy assignments will be allowed to complete.

Anahtar Kavram

Azure Policy evaluation logic takes into account hierarchical inheritance (from Management Groups down to Resource Groups) and respects explicit exclusions configured on individual policy assignments.
Bu soruyu puanla

Konular

Azure Policy Definitions, Initiatives, and Assignments