Examkin

Soru

Zorluk: ZorAzure Policy

An organization configures an Azure Policy assignment at a management group scope. The policy specifies that only virtual machines of the 'Standard_D2s_v3' size can be deployed, using the Deny effect. The subscription governed by this management group already contains several running virtual machines of the 'Standard_F4s' size. A developer who holds the Owner role for the subscription attempts to deploy a new virtual machine of the 'Standard_F4s' size.

Which of the following describes the status of the existing virtual machines and the outcome of the developer's deployment attempt?

  1. A
    The existing virtual machines continue to run and remain compliant, and the developer's deployment is successful because the Owner role bypasses the policy.
  2. The existing virtual machines continue to run but are marked as non-compliant, while the developer's attempt to deploy the new virtual machine is blocked.Cevap
  3. C
    The existing virtual machines are automatically shut down to enforce compliance, and the developer's deployment attempt is blocked.
  4. D
    The existing virtual machines are automatically resized to 'Standard_D2s_v3', while the developer's deployment is successful because the policy only audits existing resources.

Cevap

The correct answer is the option stating that existing virtual machines continue to run but are marked as non-compliant, while the developer's attempt to deploy the new virtual machine is blocked.
Azure Policy evaluations do not retroactively alter, shut down, or delete existing resources that are already deployed when a new policy is assigned. Instead, these existing resources are evaluated and reported as non-compliant in the compliance dashboard. For new resources, the 'Deny' policy effect actively blocks deployment requests, even if the user initiating the deployment has high-level permissions like the Owner role. RBAC controls who has access, while Azure Policy controls resource properties.

Adım Adım Çözüm

1
Identify the impact of Azure Policy on existing resources.
Existing resources that violate a newly assigned policy are not deleted, stopped, or modified; they continue to run but are marked as non-compliant in reports.
Azure Policy evaluations are non-destructive and retroactive changes are not automatically applied to run-time operations for the Deny effect.
2
Identify the impact of Azure Policy on new resource deployments.
The 'Deny' policy effect blocks the creation or update of any resource that does not match the policy criteria.
The Deny effect prevents deployment requests at the resource provider evaluation stage before resources are provisioned.
3
Determine if RBAC roles can bypass the policy.
The deployment is blocked regardless of the user holding the Owner role.
Azure RBAC determines who can perform actions (authorization), whereas Azure Policy defines resource properties that must be met. RBAC permissions do not override Azure Policy rules.

Anahtar Kavram

Azure Policy evaluation behavior for existing resources versus new deployments, and its relationship with Azure RBAC.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru