Examkin

Soru

Zorluk: KolayAzure Policy Governance

Your company wants to enforce tagging standards for Azure storage accounts. You need to design an Azure Policy strategy that meets the following compliance requirements:

* If a storage account is deployed without the 'Environment' tag, the deployment must be blocked.
* If a storage account is deployed without the 'CostCenter' tag, the policy should automatically add the tag with a default value of 'Unassigned' during creation.

Which two Azure Policy effects should you recommend to meet these compliance requirements?

  1. The Deny effect to block storage accounts without the Environment tagCevap
  2. The Modify effect to add the CostCenter tag with a default value during deploymentCevap
  3. C
    The Audit effect to flag non-compliant storage accounts without the Environment tag
  4. D
    The DeployIfNotExists effect to deploy a template that applies the CostCenter tag

Cevap

To meet the compliance requirements, you should use the Deny effect to block resource creation when the 'Environment' tag is missing, and the Modify effect to automatically add the 'CostCenter' tag with a default value during resource creation or update.
The requirement to block deployment when the 'Environment' tag is missing is met by using the Deny effect, which prevents resource creation. The requirement to automatically add the 'CostCenter' tag with a default value of 'Unassigned' during deployment is met by using the Modify effect, which can alter resource properties such as tags during creation or update.

Adım Adım Çözüm

1
Analyze the requirement to prevent the deployment of storage accounts that lack the 'Environment' tag.
Determine that blocking non-compliant resource creation requires an effect that prevents execution of the resource provider request.
The Deny effect evaluates the resource request during creation or update and rejects the request if it does not match the policy parameters.
2
Analyze the requirement to automatically add the 'CostCenter' tag with a default value of 'Unassigned' during deployment if it is missing.
Determine that altering the resource properties (adding a tag) during creation or update requires an effect that modifies the request payload.
The Modify effect is the recommended way to manage tags and other properties on Azure resources automatically without blocking the deployment.

Anahtar Kavram

Azure Policy effects determine the action taken when a policy rule matches a resource. Choosing between Deny, Modify, Audit, and DeployIfNotExists depends on whether the resource must be blocked, corrected during creation, logged for compliance tracking, or remediated after deployment.
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru