Examkin

Soru

Zorluk: ZorAzure Policy Governance

An enterprise, VeloTransit, manages its Azure resources using a Management Group hierarchy. The root is Velo-Corp, which has two child management groups: Velo-Prod (for production workloads) and Velo-Dev (for development environments).

The security team establishes the following compliance requirements for Velo-Prod:
- All virtual machines must have the Azure Monitor Agent installed and configured with a specific Data Collection Rule (DCR) to collect security logs.
- Any non-compliant virtual machines must have the agent automatically deployed without administrative intervention.
- For a specific legacy subscription under Velo-Prod named Sub-LegacyProd, the automatic deployment of the agent must be deferred to prevent compatibility issues. However, the compliance status of virtual machines in Sub-LegacyProd must still be evaluated and reported.

You need to design an Azure Policy strategy that meets these requirements with the least administrative overhead.

Which of the following policy designs should you recommend?

  1. A
    Create an Azure Policy definition with the DeployIfNotExists effect. Assign the policy to Velo-Prod and configure Sub-LegacyProd as an excluded scope (notScopes) in the assignment.
  2. Create an Azure Policy definition with a parameterized effect. Assign the policy to Velo-Prod with the effect parameter set to DeployIfNotExists, configuring Sub-LegacyProd as an excluded scope (notScopes) in the assignment. Create a second assignment of the same policy to Sub-LegacyProd with the effect parameter set to Audit.Cevap
  3. C
    Create an Azure Policy definition with a parameterized effect. Assign the policy to Velo-Prod with the effect parameter set to DeployIfNotExists. Create a second assignment of the same policy to Sub-LegacyProd with the effect parameter set to Audit, which automatically overrides the parent assignment.
  4. D
    Create an Azure Policy definition with the Deny effect. Assign the policy to Velo-Prod, and create an Azure Policy exemption for Sub-LegacyProd to allow virtual machine creation while triggering manual remediation tasks.

Cevap

Create an Azure Policy definition with a parameterized effect, assign it to the Velo-Prod management group with the DeployIfNotExists effect while excluding the Sub-LegacyProd subscription from that assignment, and create a second assignment of the same policy directly to Sub-LegacyProd with the Audit effect.
The correct design utilizes a single Azure Policy definition with a parameterized effect. By assigning the policy to the Velo-Prod management group with the DeployIfNotExists (DINE) effect, all child subscriptions automatically remediate non-compliant VMs. Excluding Sub-LegacyProd from this parent assignment using the 'notScopes' (Excluded Scopes) setting ensures that the remediation action is not triggered on that subscription. Finally, creating a separate assignment of the same policy directly to Sub-LegacyProd with the Audit effect satisfies the requirement to evaluate and report on compliance status without initiating automated deployment.

Adım Adım Çözüm

1
Determine the appropriate policy effect for automatic deployment of agents.
DeployIfNotExists (DINE) is selected because it allows deploying helper resources or extensions (like the Azure Monitor Agent and DCR association) when they are missing.
DINE enables automated remediation during resource creation or update without blocking deployment.
2
Select the correct mechanism to exempt a child scope from parent remediation while maintaining auditing.
Use the 'notScopes' parameter to exclude Sub-LegacyProd from the parent assignment, and define a second assignment directly on Sub-LegacyProd.
Azure Policy assignments are cumulative. Without the exclusion, the parent scope's DINE assignment would still apply to Sub-LegacyProd despite any child assignment.
3
Determine how to support different compliance actions across scopes using the same policy definition.
Parameterize the 'effect' field in the policy rule definition.
Parameterizing the effect allows reusing a single policy definition for both automatic remediation (DINE) and auditing (Audit), reducing administrative overhead.

Anahtar Kavram

Azure Policy parameterized effects, cumulative inheritance, and scope exclusions (notScopes)
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru