An administrator assigns an Azure Policy definition with a Deny effect to an Azure subscription. The policy is configured to prevent the deployment of Azure SQL databases that do not have transparent data encryption (TDE) enabled. The subscription already contains three active SQL databases that have TDE disabled.
What is the result of this policy assignment on the existing databases and on any future database deployment attempts?
- Future deployment attempts without TDE are blocked, while the three existing databases continue to run but are marked as non-compliant.Cevap
- BFuture deployment attempts without TDE are blocked, and the three existing databases are automatically deleted to enforce compliance.
- CFuture deployment attempts without TDE are allowed, but the administrator must use Role-Based Access Control (RBAC) to block user access to the non-compliant databases.
- DFuture deployment attempts without TDE are allowed, but Azure Policy will automatically modify the databases to enable TDE after deployment.
Cevap
Future deployment attempts without TDE are blocked, while the three existing databases continue to run but are marked as non-compliant.
The correct option is correct because when an Azure Policy with a Deny effect is applied, it immediately blocks any new resource deployments that do not meet the policy criteria (in this case, databases without TDE). However, existing resources that are already deployed are not modified or deleted; they are simply evaluated during the policy compliance cycle and flagged as non-compliant in the compliance dashboard.
Adım Adım Çözüm
Anahtar Kavram
Azure Policy Deny effect behavior on new and existing resources
Tahmini Süre:1m 0s