Examkin

Soru

Zorluk: OrtaAzure Policy Governance

ShopGlobe Logistics is designing an Azure governance strategy for its resource hierarchy, which consists of a Production management group and a Non-Production management group. The company must satisfy the following compliance requirements:

1. All virtual machines deployed in the Production management group must be audited if they do not use managed disks.
2. All storage accounts deployed in the Production management group must have HTTPS traffic enforcement enabled. If a storage account is created with HTTPS traffic disabled, it must be automatically remediated during deployment without blocking the creation.
3. Public IP addresses must not be created in the Non-Production management group, except for resources deployed in a specific resource group named 'shared-dmz-rg'.

To minimize administrative overhead, which of the following policy configurations should you implement? (Select TWO.)

  1. Group the virtual machine auditing policy and the storage account HTTPS remediation policy using the Modify effect into a single policy initiative, and assign it to the Production management group.Cevap
  2. Assign a policy that denies public IP address creation to the Non-Production management group, and add the 'shared-dmz-rg' resource group to the policy assignment's exclusion scope (notScopes).Cevap
  3. C
    Assign a policy using the Deny effect to the Production management group to block the deployment of storage accounts that do not have secure transfer enabled.
  4. D
    Assign the virtual machine auditing policy and the storage account HTTPS policy as individual assignments to each subscription under the Production management group.

Cevap

Group the VM auditing policy and storage account HTTPS remediation policy (with Modify effect) into an initiative assigned to the Production management group, and assign a Deny policy for public IPs to the Non-Production management group with the 'shared-dmz-rg' added to the exclusion scope (notScopes).
Grouping the policies into a single initiative and assigning it to the Production management group ensures that all child subscriptions inherit the settings, minimizing management effort. The Modify effect automatically sets the HTTPS secure transfer property during resource deployment without failure. For the Non-Production requirement, assigning a Deny policy to the management group and using the exclusion scope (notScopes) to exempt the specific resource group is the standard, low-overhead way to manage exceptions.

Adım Adım Çözüm

1
Select the correct policy effects based on compliance requirements.
Identify that the virtual machine managed disk compliance requires 'Audit' (to report non-compliance without blocking), the storage account HTTPS secure transfer requires 'Modify' (to change the property during resource creation), and public IP restriction requires 'Deny' (to block creation).
Matching business compliance rules to Azure Policy effects ensures correct enforcement behavior.
2
Determine the proper assignment scope and grouping to minimize overhead.
Combine the 'Audit' and 'Modify' policies into a single policy initiative and assign it to the Production management group scope, allowing inheritance to cover all child subscriptions.
Policy initiatives and management group assignments reduce the number of separate objects that must be managed.
3
Configure exclusions for specific resource scopes.
Assign the Deny policy for public IPs to the Non-Production management group, and specify the resource ID of the 'shared-dmz-rg' resource group in the 'notScopes' (exclusions) property of the assignment.
Exclusion scopes allow child resources/resource groups to be exempt from inherited policies without needing complex policy rules or breaking inheritance.

Anahtar Kavram

Azure Policy Governance using initiatives, inheritance, exclusion scopes (notScopes), and appropriate policy effects.
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru