Examkin

Soru

Zorluk: KolayAzure Policy

An administrator assigns an Azure Policy definition with the Deny effect to a resource group to prevent the creation of virtual machines that lack a 'CostCenter' tag. A user who holds the Owner role for the Azure subscription attempts to deploy a new virtual machine without this tag to the resource group. What is the result of this deployment attempt?

  1. The deployment is blocked, and the virtual machine is not created.Cevap
  2. B
    The deployment succeeds because the Owner role grants permissions that override Azure Policy restrictions.
  3. C
    The deployment succeeds, but the virtual machine is automatically deleted during the next compliance evaluation.
  4. D
    The deployment succeeds, and the missing 'CostCenter' tag is automatically added to the virtual machine.

Cevap

The deployment is blocked, and the virtual machine is not created.
The correct option is that the deployment is blocked and the virtual machine is not created. Azure Policy evaluates resource creation requests before they are deployed. When a resource does not meet the policy criteria and the policy is configured with the Deny effect, the deployment is stopped immediately at the API level, preventing the resource from ever being created.

Adım Adım Çözüm

1
Identify the Azure Policy effect assigned.
The policy uses the Deny effect.
The Deny effect is designed to prevent resource creation requests that do not comply with the policy rules.
2
Evaluate the compliance of the deployment request.
The deployment request lacks the required 'CostCenter' tag, making it non-compliant.
The policy requires the 'CostCenter' tag to be present on all virtual machines.
3
Determine the impact of the user's role on policy enforcement.
The Owner role does not bypass policy enforcement.
Azure Policy rules are enforced at the resource provider level for all users, including those with elevated RBAC roles like Owner.
4
Determine the final outcome of the deployment request.
The deployment request is rejected, and the virtual machine is not created.
Because the resource is non-compliant and the policy effect is Deny, Azure Resource Manager blocks the deployment before it is initiated.

Anahtar Kavram

Azure Policy Deny Effect Enforcement
Tahmini Süre:45s
Bu soruyu puanla

Konular

Azure Policy

Bu konudan daha fazla soru