Examkin

Soru

Zorluk: Çok zorAzure Policy Governance

An enterprise manages its Azure resources using a Management Group hierarchy consisting of a Root Management Group, under which sit a Production Management Group (containing production subscriptions) and a Non-Production Management Group (containing Dev and Test subscriptions).

You need to design a governance strategy using Azure Policy to meet the following requirements:
1. All virtual networks deployed within the Production Management Group must have Azure Network Watcher flow logs enabled and configured to send data to a central Log Analytics workspace. Non-compliant virtual networks must be automatically remediated during deployment without blocking the resource creation.
2. Virtual machines of the G-series must be blocked from deployment within the Test subscription to control costs. However, developers must be allowed to deploy these virtual machines within a specific resource group named PerfTesting-RG inside the Test subscription.
3. Administrative overhead for managing policy assignments and compliance must be minimized.

Which policy design should you recommend?

  1. Assign a policy definition using the DeployIfNotExists effect to the Production Management Group to configure Network Watcher flow logs. Assign a policy definition using the Deny effect to the Test subscription to restrict G-series virtual machines, and add the PerfTesting-RG resource group to the exclusion scope (notScopes) of this assignment.Cevap
  2. B
    Assign a policy definition using the Deny effect to the Production Management Group to block virtual networks without flow logs. Assign a policy definition using the DeployIfNotExists effect to the Test subscription to remediate virtual machines that are not of the G-series, using Policy Exemptions for the PerfTesting-RG resource group.
  3. C
    Assign a policy definition using the Audit effect to the Production Management Group for flow logs, and configure an Azure Automation runbook to enable flow logs. Assign a policy definition using the Deny effect to the Test subscription for G-series virtual machines, and create a policy exemption for the PerfTesting-RG resource group.
  4. D
    Create a policy initiative containing both policy definitions. Assign the initiative at the Root Management Group, and configure policy exemptions for the entire Non-Production Management Group for the flow logs policy, and another policy exemption for the PerfTesting-RG resource group for the virtual machine size policy.

Cevap

Assign a policy definition using the DeployIfNotExists effect to the Production Management Group to configure Network Watcher flow logs. Assign a policy definition using the Deny effect to the Test subscription to restrict G-series virtual machines, and add the PerfTesting-RG resource group to the exclusion scope (notScopes) of this assignment.
The correct design uses the DeployIfNotExists effect at the Production Management Group level to automatically and natively remediate non-compliant virtual networks by deploying Network Watcher flow logs without blocking deployment. To restrict G-series virtual machines, a Deny policy is assigned directly to the Test subscription. Adding the performance testing resource group to the notScopes property of the assignment excludes it from evaluation permanently, which is cleaner and carries less administrative overhead than managing separate policy assignments or using formal Policy Exemptions, which are typically designed for temporary exceptions.

Adım Adım Çözüm

1
Select the policy effect for Network Watcher flow logs.
DeployIfNotExists effect is chosen.
The requirement states that non-compliant resources must be automatically remediated during deployment without blocking resource creation. DeployIfNotExists evaluates the resource and deploys a template to remediate it if it does not exist.
2
Select the policy effect for VM size restrictions.
Deny effect is chosen.
The requirement states that G-series virtual machines must be blocked from deployment. The Deny effect prevents resource creation if it matches the policy rule.
3
Determine the assignment scope and exclusion mechanism for the VM restriction.
Assign to the Test subscription and exclude the PerfTesting-RG resource group using the notScopes property.
Using the notScopes property during assignment prevents the policy from evaluating resources in the designated resource group, minimizing administrative overhead compared to setting up individual Policy Exemptions or separate assignments.
4
Determine the assignment scope for the flow logs policy.
Assign directly to the Production Management Group.
Targeting the assignment directly to the Production Management Group ensures the policy only applies where needed, eliminating the need to manage exemptions for the Non-Production Management Group.

Anahtar Kavram

Azure Policy effects (DeployIfNotExists, Deny) and assignment scopes including exclusions (notScopes) to enforce compliance with minimal administrative overhead.
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru