An organization has an Azure resource group named RG-Production that contains ten existing virtual machines. None of these virtual machines have any tags. An administrator assigns an Azure Policy definition to RG-Production that denies the deployment of any resource that does not contain a tag named 'CostCenter'.
A developer who is assigned the Owner role for RG-Production attempts to perform two tasks:
1. Deploy a new virtual machine without specifying any tags.
2. Start one of the existing virtual machines.
What is the outcome of these tasks?
- The deployment of the new virtual machine is blocked, but the existing virtual machine starts successfully.Cevap
- BBoth tasks are blocked because the existing virtual machines in the resource group must be compliant before any further operations can occur.
- CThe deployment of the new virtual machine is successful because the Owner role grant overrides all Azure Policy restrictions.
- DThe deployment of the new virtual machine is blocked, and the existing virtual machines are automatically stopped or deleted to enforce compliance.
Cevap
The deployment of the new virtual machine is blocked, but the existing virtual machine starts successfully.
The option stating that the deployment of the new virtual machine is blocked, but the existing virtual machine starts successfully is correct. Azure Policy evaluates resource compliance during deployment. Since the new virtual machine lacks the required tag, the Deny policy blocks its creation. However, Azure Policy does not retroactively delete or stop existing non-compliant resources, nor does it block operational state changes like starting an existing VM.
Adım Adım Çözüm
Anahtar Kavram
Azure Policy evaluation timing, enforcement, and interaction with RBAC
Tahmini Süre:2m 0s