Examkin

Soru

Zorluk: Çok zorAzure Policy

An Azure subscription contains several existing storage accounts that do not have secure transfer enabled. An administrator who is assigned the Owner role at the subscription level applies a new Azure Policy to the subscription. The policy uses a 'Deny' effect to prevent the creation of storage accounts that have secure transfer disabled. The administrator then attempts to create a new storage account with secure transfer disabled. What is the outcome of the administrator's attempt to create the new storage account, and how are the existing storage accounts affected?

  1. The creation of the new storage account is blocked, and the existing storage accounts remain unchanged but are marked as non-compliant in the compliance dashboard.Cevap
  2. B
    The new storage account is successfully created because the Owner role overrides Azure Policy, and the existing storage accounts remain marked as compliant.
  3. C
    The creation of the new storage account is blocked, and the existing storage accounts are automatically updated by Azure Policy to enable secure transfer.
  4. D
    The creation of the new storage account is blocked, and the existing storage accounts are automatically deleted by Azure Policy to enforce compliance.

Cevap

The creation of the new storage account is blocked, and the existing storage accounts remain unchanged but are marked as non-compliant in the compliance dashboard.
The correct answer correctly states that the creation of the new storage account is blocked because Azure Policy rules apply to all resource deployment attempts, regardless of the user's RBAC roles. Furthermore, Azure Policy does not automatically alter or delete existing resources that do not comply with the newly applied policy; it merely identifies them as non-compliant in reports.

Adım Adım Çözüm

1
Evaluate the effect of Azure Policy on the new resource request.
The request to create a new storage account with secure transfer disabled violates the subscription-level policy with the 'Deny' effect.
The 'Deny' effect prevents the resource provider from creating or updating resources that do not match the policy definition.
2
Determine if user permissions can bypass the Azure Policy block.
The creation is blocked despite the user having the Owner role.
Azure Role-Based Access Control (RBAC) defines what actions a user can perform, whereas Azure Policy defines resource properties. RBAC roles do not override or bypass Azure Policy restrictions.
3
Analyze the effect of the new policy on pre-existing resources.
The existing non-compliant storage accounts are not modified or deleted, but they are flagged as non-compliant.
Azure Policy does not retroactively change or delete existing resources when a new 'Deny' policy is assigned. Instead, it marks them as non-compliant in compliance reports.

Anahtar Kavram

Azure Policy effects and compliance behavior, and its relationship with Azure Role-Based Access Control (RBAC)
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru