Examkin

Soru

Zorluk: OrtaAzure Policy

An administrator assigns an Azure Policy definition to an Azure subscription, but adds a specific resource group to the exclusion list of the assignment. Is the statement true that resources violating the policy can still be successfully deployed within the excluded resource group?

Cevap: Cevap

Cevap

True, because excluding a resource group from a policy assignment prevents the policy from being evaluated or enforced on resources within that group.
The statement is true because the exclusion list (NotScopes) in an Azure Policy assignment removes the specified scope (such as a resource group) from the policy's evaluation. Therefore, any resource creation or update within that excluded scope will not be blocked or audited by the policy, even if the resource violates the policy rules.

Adım Adım Çözüm

1
Analyze the scope of the policy assignment.
The policy is assigned at the subscription level, which by default applies to all resource groups and resources within that subscription due to inheritance.
To understand the base scope of policy enforcement.
2
Evaluate the effect of the exclusion list (NotScopes).
The specified resource group is added to the exclusion list, which exempts it from this specific policy assignment.
To determine how exclusions modify the scope of policy enforcement.
3
Determine the outcome of deploying a non-compliant resource in the excluded resource group.
Since the resource group is excluded, the policy definition is not enforced within it, and the deployment of the non-compliant resource is allowed.
To form the final true/false evaluation of the statement.

Anahtar Kavram

Azure Policy exclusions and inheritance
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru