Examkin

Soru

Zorluk: OrtaAzure Policy

An IT administrator assigns an Azure Policy definition to a subscription. The policy is configured with a 'Deny' effect to prevent the creation of storage accounts that allow public network access. The subscription already contains five storage accounts that allow public network access.

What is the result of assigning this policy on the five existing storage accounts?

  1. A
    The existing storage accounts will be automatically modified to disable public network access to conform to the policy.
  2. B
    The existing storage accounts will be automatically deleted to prevent security non-compliance.
  3. The existing storage accounts will remain active and unmodified, but they will be reported as non-compliant in the Azure Policy compliance dashboard.Cevap
  4. D
    The existing storage accounts will have their Azure RBAC roles revoked, preventing users from accessing them.

Cevap

The existing storage accounts will remain active and unmodified, but they will be reported as non-compliant in the Azure Policy compliance dashboard.
The correct answer states that the existing storage accounts will remain active and unmodified, but they will be reported as non-compliant in the Azure Policy compliance dashboard. When a new policy definition is assigned to a scope, Azure Policy scans all existing resources within that scope. If any existing resources do not meet the policy criteria, they are flagged as non-compliant in compliance reporting. The policy does not retroactively modify, stop, or delete pre-existing resources, even if the policy uses the 'Deny' effect.

Adım Adım Çözüm

1
Determine the effect of the newly assigned Azure Policy on new resource deployments.
Any new storage account deployments that allow public network access will be blocked (denied).
The policy is configured with the 'Deny' effect.
2
Evaluate the retroactive impact of the 'Deny' policy on existing resources.
Existing storage accounts remain unmodified and active.
Azure Policy is non-destructive and does not retroactively delete or alter existing resources when a new 'Deny' policy is assigned.
3
Identify how existing non-compliant resources are represented in Azure Policy.
The existing storage accounts are flagged as non-compliant in compliance reports.
Azure Policy runs compliance evaluation scans on existing resources and reports their status to administrators without modifying the resources.

Anahtar Kavram

Azure Policy evaluation of existing resources
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru