Examkin

Soru

Zorluk: OrtaManagement Groups Hierarchies

A healthcare company, HealthPulse Diagnostics, uses the following Azure Management Group (MG) hierarchy to organize its subscriptions:

- Tenant Root Group
- HealthPulse-MG (Management Group)
- Clinical-MG (Management Group)
- SubscriptionA
- ResourceGroup1
- Research-MG (Management Group)
- SubscriptionB

The following settings are configured:

1. At HealthPulse-MG, an Azure Policy is assigned that denies the deployment of virtual machines unless they use the 'Standard_D2s_v3' SKU.
2. At Clinical-MG, an Azure Policy is assigned that denies the deployment of virtual machines unless they use the 'Standard_D4s_v3' SKU.
3. At SubscriptionA, User1 is assigned the Contributor role.

User1 attempts to deploy a new virtual machine using the 'Standard_D4s_v3' SKU into ResourceGroup1.

What is the outcome of the deployment attempt?

  1. The deployment fails because the Azure Policy assigned at HealthPulse-MG is inherited and must be satisfied, even though the VM complies with the policy at Clinical-MG.Cevap
  2. B
    The deployment succeeds because the policy assigned at Clinical-MG overrides the policy assigned at the parent HealthPulse-MG.
  3. C
    The deployment succeeds because the Contributor role assignment on SubscriptionA grants User1 the permission to bypass parent management group policies.
  4. D
    The deployment succeeds because policies assigned at the management group level only apply to resources created directly in the management groups, not within subscriptions.

Cevap

The deployment fails because the Azure Policy assigned at HealthPulse-MG is inherited and must be satisfied, even though the VM complies with the policy at Clinical-MG.
The correct answer is that the deployment fails because Azure Policy assignments are cumulative and inherited down the Management Group hierarchy. A resource must comply with all applied policies. Since the VM SKU is 'Standard_D4s_v3', it violates the policy at HealthPulse-MG which restricts SKUs to 'Standard_D2s_v3'.

Adım Adım Çözüm

1
Trace the inheritance of Azure Policies down the Management Group hierarchy.
ResourceGroup1 inherits the 'Standard_D2s_v3' SKU restriction policy from HealthPulse-MG and the 'Standard_D4s_v3' SKU restriction policy from Clinical-MG.
Azure Policy assignments at parent scopes are inherited by all child resources.
2
Determine the compliance requirements for the virtual machine.
The VM must satisfy all applied policies. Therefore, the VM must simultaneously meet both SKU restrictions, which is impossible.
Azure Policy evaluation is cumulative (logical AND).
3
Evaluate the User1 permissions against the deployment constraints.
Although User1 has the Contributor role on SubscriptionA, this role does not override policy compliance checks. The deployment is blocked.
RBAC defines who can perform actions, whereas Azure Policy defines resource properties. Both must be satisfied for a successful deployment.

Anahtar Kavram

Azure Policy inheritance and cumulative evaluation across Management Group hierarchies
Bu soruyu puanla

Konular

Management Groups Hierarchies

Bu konudan daha fazla soru