Examkin

Soru

Zorluk: ZorAzure Policy

An administrator assigns an Azure Policy definition that blocks public network access to storage accounts (using the 'Deny' effect) at a management group level. A developer subsequently creates a new subscription under this management group, creates a new resource group within that subscription, and attempts to deploy a storage account with public network access enabled. The deployment will be blocked due to policy inheritance. Is this statement true?

Cevap: Cevap

Cevap

True
The statement is true because Azure Policy assignments are inherited down the resource hierarchy (Management Groups -> Subscriptions -> Resource Groups -> Resources). Any resources created in child scopes, even after the policy is assigned, must comply with the policy. The 'Deny' effect actively blocks the creation of non-compliant resources.

Adım Adım Çözüm

1
Determine the policy assignment scope and inheritance behavior.
The policy is assigned at the management group level, meaning the policy rule is inherited by all child scopes, including any subscriptions and resource groups nested beneath it.
Azure governance follows a hierarchy where child scopes automatically inherit policy assignments from parent scopes.
2
Evaluate the impact on newly created resources and scopes.
Newly created subscriptions and resource groups under the management group immediately inherit the active policy definition.
Inheritance is dynamic and applies to all current and future resources within the scope of the assignment.
3
Determine the effect of the policy on the deployment attempt.
The 'Deny' effect blocks the creation of the non-compliant storage account.
The 'Deny' effect is evaluated during resource creation or update and prevents the deployment if it does not comply with the policy rules.

Anahtar Kavram

Azure Policy inheritance and enforcement scopes
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru