Examkin

Soru

Zorluk: OrtaAzure Policy

An administrator with the Owner role on an Azure subscription attempts to deploy a new virtual machine to the East US region. However, an Azure Policy definition with a Deny effect is assigned to the subscription, restricting all resource deployments to the West US region. What is the outcome of this deployment attempt?

  1. A
    The deployment succeeds because the Owner role grants administrative permissions that bypass Azure Policy restrictions.
  2. B
    The deployment succeeds, but the virtual machine is automatically relocated to the West US region to comply with the policy.
  3. The deployment is blocked because Azure Policy restrictions are enforced regardless of the user's role-based access control (RBAC) privileges.Cevap
  4. D
    The deployment succeeds, but the virtual machine is flagged as non-compliant in the Azure Policy dashboard.

Cevap

The deployment is blocked because Azure Policy restrictions are enforced regardless of the user's role-based access control (RBAC) privileges.
Azure Policy evaluations occur at the Azure Resource Manager level before any resource is created. A Deny policy blocks non-compliant deployment requests immediately, and this enforcement applies to all users, including those assigned the Owner role. RBAC roles determine who has access, but Azure Policy defines the compliance boundaries of the resources.

Adım Adım Çözüm

1
Identify the assigned policy's effect and rules.
A policy with a Deny effect restricts deployments to the West US region.
This establishes that any deployment attempt to a different region (like East US) triggers a block unless bypassed.
2
Evaluate the relationship between the user's RBAC role and Azure Policy.
The user is a subscription Owner, but Azure Policy is applied at the resource deployment level, independent of RBAC.
RBAC determines what operations a user can initiate, but Azure Policy enforces properties of the resources being created.
3
Determine the final outcome of the deployment request.
The deployment request fails at the validation stage and is blocked.
Because the policy uses the Deny effect, the deployment is rejected before resource creation begins.

Anahtar Kavram

Interaction between Azure Policy and Role-Based Access Control (RBAC)
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru