Examkin

Soru

Zorluk: KolayAzure Policy Definitions, Initiatives, and Assignments

An organization manages its Azure environment using a management group named Tenant-MG, which contains an Azure subscription named Sub-01. Sub-01 contains two resource groups named RG-Prod and RG-Dev.

You assign an Azure Policy definition that restricts allowed virtual machine SKUs at the Sub-01 subscription level. You add the RG-Dev resource group to the exclusion list of this policy assignment. A developer attempts to deploy a virtual machine with a disallowed SKU to the RG-Dev resource group.

What is the outcome of this deployment?

  1. The deployment succeeds because the exclusion at the resource group level prevents the policy from being applied to resources within RG-Dev.Cevap
  2. B
    The deployment is blocked because the Deny effect is evaluated at the subscription level before resource group exclusions are processed.
  3. C
    The deployment succeeds, but the resource group is evaluated as non-compliant and is automatically set to a Disabled state.
  4. D
    The deployment is blocked because exclusions can only disable policy evaluation for Audit or Append effects, not Deny effects.

Cevap

The deployment succeeds because the exclusion at the resource group level prevents the policy from being applied to resources within RG-Dev.
The deployment succeeds because policy exclusions allow you to exempt specific resource groups or resources from a policy assignment. Since the assignment is excluded from RG-Dev, any virtual machines deployed inside RG-Dev are not evaluated against this policy, allowing the VM to be deployed even with a disallowed SKU.

Adım Adım Çözüm

1
Determine the scope of the policy assignment and the resource group location of the target deployment.
The policy is assigned at the subscription level (Sub-01), but the target resource group (RG-Dev) is explicitly listed as an exclusion on that assignment.
Exclusions define scopes within the assignment's boundary where the policy will not be applied.
2
Evaluate the effect of the exclusion on policy enforcement for resources in the excluded scope.
Resources in RG-Dev are completely exempt from the policy assignment and do not undergo evaluation.
When a resource group is excluded from an assignment, Azure Policy ignores all resources within that group for this specific assignment.
3
Conclude the final deployment outcome for the virtual machine with the disallowed SKU in RG-Dev.
The deployment of the virtual machine succeeds.
Since the policy is not evaluated for RG-Dev, the restriction on virtual machine SKUs does not apply to this deployment.

Anahtar Kavram

Azure Policy assignment scopes and exclusions
Bu soruyu puanla

Konular

Azure Policy Definitions, Initiatives, and Assignments