Examkin

Soru

Zorluk: ZorAzure Policy Governance

A healthcare provider, MedVitals Systems, operates a hierarchical Azure resource structure. The Root Management Group contains a child Management Group named Shared-Services. A subscription named Archive-Billing is placed within the Shared-Services Management Group. You need to design an Azure governance architecture to meet the following requirements:
- Ensure that any newly deployed virtual machines (VMs) automatically have the dependency agent installed.
- Ensure that the Archive-Billing subscription is not subject to the VM agent requirement to prevent unnecessary agent installations on archived workloads.
- Ensure that all storage accounts enforce secure transfer (HTTPS). Existing non-compliant storage accounts must be flagged in compliance reports but must not be modified or blocked.
- Minimize administrative overhead.

Which design should you recommend?

  1. Assign a policy definition that uses the DeployIfNotExists effect for the VM dependency agent to the Shared-Services Management Group, with the Archive-Billing subscription specified in the exclusion scope (notScopes) of the assignment. Assign a policy definition that uses the Deny effect for storage account secure transfer to the Root Management Group.Cevap
  2. B
    Assign a policy definition that uses the DeployIfNotExists effect for the VM dependency agent to the Shared-Services Management Group. Create a separate policy assignment at the Archive-Billing subscription scope with the effect set to Disabled. Assign a policy definition that uses the Audit effect for storage account secure transfer to the Root Management Group, and configure a remediation task to apply the secure transfer setting.
  3. C
    Assign a policy definition that uses the Modify effect for the VM dependency agent to the Shared-Services Management Group, and exclude the Archive-Billing subscription by using Azure role-based access control (RBAC) deny assignments. Assign a policy definition that uses the Deny effect for storage account secure transfer to the Root Management Group.
  4. D
    Assign a policy definition that uses the Audit effect for the VM dependency agent to the Shared-Services Management Group, and configure an Azure Automation runbook to install the agent. Assign a policy definition that uses the DeployIfNotExists effect for storage account secure transfer to the Root Management Group.

Cevap

Assign a policy definition that uses the DeployIfNotExists effect for the VM dependency agent to the Shared-Services Management Group, with the Archive-Billing subscription specified in the exclusion scope (notScopes) of the assignment. Assign a policy definition that uses the Deny effect for storage account secure transfer to the Root Management Group.
The correct architecture uses a DeployIfNotExists policy assigned at the management group level to automate the installation of the VM dependency agent. To exclude the Archive-Billing subscription, the subscription is configured in the exclusion scope (notScopes) of the assignment, which avoids the overhead of managing multiple assignments. To enforce secure transfer on storage accounts, a Deny policy is assigned at the Root Management Group. The Deny effect blocks the creation of new non-compliant resources, while existing resources are only evaluated and marked as non-compliant in reports without being altered or blocked, satisfying all requirements with the lowest administrative overhead.

Adım Adım Çözüm

1
Determine the appropriate policy effect for VM agent installation.
DeployIfNotExists (DINE) is selected because installing an agent involves deploying a VM extension, which is a nested resource template deployment.
Using DINE automates the deployment of missing extension resources during resource creation or remediation.
2
Identify the mechanism to exclude the Archive-Billing subscription.
Exclusion scopes (notScopes) are configured on the policy assignment applied at the Shared-Services Management Group level.
Exclusion scopes are evaluated natively during assignment, avoiding the administrative overhead of creating duplicate policy assignments or disabling policies at child scopes.
3
Select the correct policy effect for storage account secure transfer compliance.
The Deny effect is chosen for the storage account secure transfer policy.
The Deny effect prevents the creation or update of any new non-compliant storage accounts. For existing non-compliant storage accounts, Azure Policy flags them as non-compliant in reports but does not modify, delete, or block them, aligning perfectly with the requirement.

Anahtar Kavram

Azure Policy effects and assignment scope configuration
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru