Examkin

Soru

Zorluk: ZorAzure Policy

An administrator assigns an Azure Policy with the 'Modify' effect to remediate non-compliant resources within a resource group. To perform the remediation of these resources, Azure Policy executes the remediation tasks by using the security credentials of the administrator who assigned the policy. Is this statement true or false?

Cevap: Cevap

Cevap

False
The correct answer is false because Azure Policy remediation tasks do not run under the security credentials of the administrator who assigned the policy; instead, they require a managed identity with the necessary RBAC permissions.

Adım Adım Çözüm

1
Analyze how Azure Policy remediation works for effects like 'Modify' and 'DeployIfNotExists'.
Identify that these effects require a managed identity to perform remediation actions.
Remediation involves changing or creating Azure resources, which requires write permissions.
2
Determine the security context used to execute these remediation tasks.
Recognize that Azure Policy creates a managed identity (either system-assigned or user-assigned) and uses that identity's permissions.
Azure enforces security boundaries and does not impersonate the user credentials of the administrator.
3
Evaluate the statement in the prompt against these findings.
The statement claims the tasks are run using the security credentials of the administrator who assigned the policy, which is false.
This contradicts the security model of Azure Policy remediation which uses managed identities.

Anahtar Kavram

Azure Policy Remediation Security Context
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru