Examkin

Soru

Zorluk: ZorAzure Policy Governance

An enterprise manages its Azure resources using a management group structure. Under the root management group, there is a parent management group named Corp-MG, which has two child management groups named Corp-Prod-MG and Corp-Dev-MG.

You are designing an Azure Policy governance solution to meet the following requirements:
1. All virtual machines deployed to Corp-Prod-MG must have the Azure Monitor Agent extension automatically installed.
2. All Azure Storage accounts deployed to Corp-Dev-MG must have public network access disabled. Any attempts to deploy a storage account with public network access enabled must be blocked, except for resources deployed within a specific resource group named Dev-Sandbox-RG.

You need to configure the policies to enforce these compliance requirements while minimizing administrative overhead.

Which two configuration actions should you include in the design? (Select TWO.)

  1. Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Prod-MG scope to install the Azure Monitor Agent extension on virtual machines.Cevap
  2. Assign an Azure Policy with the Deny effect at the Corp-Dev-MG scope, and configure the Dev-Sandbox-RG resource group ID in the notScopes property of the policy assignment.Cevap
  3. C
    Assign an Azure Policy with the Modify effect at the Corp-Prod-MG scope to deploy the Azure Monitor Agent extension on virtual machines.
  4. D
    Assign an Azure Policy with the Audit effect at the Corp-Dev-MG scope, and implement an Azure Automation runbook to delete non-compliant storage accounts.

Cevap

Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Prod-MG scope to install the Azure Monitor Agent extension on virtual machines, and assign an Azure Policy with the Deny effect at the Corp-Dev-MG scope, configuring the Dev-Sandbox-RG resource group ID in the notScopes property of the policy assignment.
To automatically install the Azure Monitor Agent extension on virtual machines, a policy with the DeployIfNotExists effect should be assigned at the Corp-Prod-MG scope. To block non-compliant storage accounts while excluding the sandbox environment, a policy with the Deny effect should be assigned to the Corp-Dev-MG scope, with the Dev-Sandbox-RG resource group ID added to the notScopes property of the policy assignment. This ensures compliance without manual intervention or excessive policy assignments.

Adım Adım Çözüm

1
Determine the appropriate policy effect for deploying the Azure Monitor Agent extension on virtual machines.
Select DeployIfNotExists.
Virtual machine extensions are child resources, and DeployIfNotExists is the standard effect for deploying nested resources or templates when a resource is created or updated.
2
Determine the policy effect to prevent storage accounts from enabling public network access.
Select the Deny effect.
The Deny effect prevents the creation or modification of resources that do not match the compliance rule, ensuring that public network access cannot be enabled.
3
Identify how to exclude the specific sandbox resource group from the policy enforcement scope.
Configure the notScopes property on the policy assignment to include the resource ID of the sandbox resource group.
The notScopes property excludes specific resource groups or individual resources from the scope of a policy assignment, preventing enforcement there without requiring separate policy assignments.

Anahtar Kavram

Enforcing compliance at scale using Azure Policy effects (DeployIfNotExists, Deny) and targeting scopes using the notScopes exclusion property.
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru