Examkin

Soru

Zorluk: OrtaAzure Policy Definitions, Initiatives, and Assignments

An organization has an Azure resource hierarchy consisting of a management group named MG-Finance and two child subscriptions named Sub-Billing and Sub-Reporting.

An administrator creates an Azure Policy initiative named Finance-Compliance-Initiative that contains the following policy definitions:
- A policy that restricts storage account creation to the East US region (Effect: Deny).
- A policy that requires secure transfer (HTTPS) to be enabled for all storage accounts (Effect: Deny).

The administrator assigns Finance-Compliance-Initiative to MG-Finance and adds Sub-Reporting to the exclusion list of the assignment.

The administrator then attempts to perform the following operations:
- Operation A: In Sub-Billing, create a storage account in the West US region with HTTPS enabled.
- Operation B: In Sub-Reporting, create a storage account in the West US region with HTTPS disabled.

Which of the following describes the outcome of these operations?

  1. Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.Cevap
  2. B
    Both Operation A and Operation B are blocked because policy exclusions assigned to initiatives do not override location restrictions.
  3. C
    Operation A succeeds because secure transfer is enabled, but Operation B is blocked because it violates the secure transfer policy.
  4. D
    Both Operation A and Operation B are allowed, but the storage account created in Operation B is flagged as non-compliant because the secure transfer policy uses an Audit effect by default.

Cevap

Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.
The correct option is that Operation A is blocked due to the location policy, and Operation B succeeds. Azure Policy evaluates assignments down the resource hierarchy. Because the initiative is assigned to the management group, it inherits to child subscriptions. However, because Sub-Reporting is explicitly excluded, none of the policies apply to Operation B, allowing the storage account to be created. Sub-Billing is not excluded, so its resource creation (Operation A) is evaluated. Even though secure transfer is enabled, the location (West US) violates the allowed locations policy, and the Deny effect prevents the creation.

Adım Adım Çözüm

1
Identify the scope of the policy initiative assignment and inheritance.
The initiative is assigned at MG-Finance, which covers child subscriptions Sub-Billing and Sub-Reporting by inheritance.
Understanding scope helps determine which resources are subject to policy evaluation.
2
Apply the exclusion configuration to the inheritance path.
Sub-Reporting is excluded, meaning no policies in the initiative apply to it. Sub-Billing remains fully subject to the policies.
Exclusions bypass policy evaluation for the designated scope.
3
Evaluate Operation A against the active policies in Sub-Billing.
The location is West US, which violates the 'East US only' allowed locations policy. Because the policy effect is Deny, the operation is blocked.
A Deny effect blocks the resource creation immediately if any policy rule in the assignment is violated.
4
Evaluate Operation B against the active policies in Sub-Reporting.
Since Sub-Reporting is excluded from the assignment, the policies are not evaluated, allowing the operation to succeed.
Excluding a scope prevents any actions from being blocked or audited by the assignment.

Anahtar Kavram

Azure Policy scopes, exclusions, inheritance, and the Deny effect.
Bu soruyu puanla

Konular

Azure Policy Definitions, Initiatives, and Assignments