Examkin

Soru

Zorluk: ZorAzure Policy Governance

Zephyr Health designs its Azure environment using a management group hierarchy. Under the root management group, a production management group named Zephyr-Prod contains multiple subscriptions, including Prod-App1. A security requirement states that all Azure Virtual Machines deployed to subscriptions under Zephyr-Prod must be automatically configured to back up to a Recovery Services vault. If a virtual machine is deployed without backup, it must be automatically remediated by deploying the required backup extension. However, virtual machines deployed in a specific resource group named In-Memory-DB-RG within Prod-App1 must be exempted from this backup requirement due to performance and latency constraints. Which Azure Policy strategy should you recommend to meet these compliance requirements while minimizing administrative overhead?

  1. Assign an Azure Policy Initiative containing a DeployIfNotExists policy for Azure Backup at the Zephyr-Prod management group scope, and add the resource ID of the In-Memory-DB-RG resource group to the notScopes property of the policy assignment.Cevap
  2. B
    Assign an Azure Policy Initiative containing a Modify policy for Azure Backup at the Zephyr-Prod management group scope, and configure a manual Azure Logic App to execute daily remediation tasks on all virtual machines outside the In-Memory-DB-RG resource group.
  3. C
    Assign an Azure Policy Initiative containing a Deny policy for Azure Backup at the Zephyr-Prod management group scope, and configure the notScopes property of the assignment to exclude the In-Memory-DB-RG resource group.
  4. D
    Assign an Azure Policy Initiative containing an Audit policy for Azure Backup at the Zephyr-Prod management group scope, and configure an Azure Automation runbook to deploy the backup extension for any non-compliant virtual machines except those in the In-Memory-DB-RG resource group.

Cevap

Assign an Azure Policy Initiative containing a DeployIfNotExists policy for Azure Backup at the Zephyr-Prod management group scope, and add the resource ID of the In-Memory-DB-RG resource group to the notScopes property of the policy assignment.
The correct strategy uses the DeployIfNotExists effect, which checks for the existence of a nested resource (the backup configuration/extension) and deploys it if missing, ensuring automatic remediation. Assigning this at the management group level applies it globally to child subscriptions, and using the notScopes property on the assignment successfully exempts the latency-sensitive database resource group with minimal administration.

Adım Adım Çözüm

1
Determine the correct policy effect for deploying dependent resources.
DeployIfNotExists is selected.
Deploying a backup extension and association to configure a VM for backup requires deploying nested resources, which is the primary purpose of the DeployIfNotExists (DINE) effect.
2
Determine the optimal assignment scope to enforce compliance with minimal overhead.
Zephyr-Prod management group scope is selected.
Assigning the policy at the management group level ensures that all existing and future subscriptions underneath automatically inherit the policy, avoiding repetitive subscription-level assignments.
3
Determine the mechanism to exempt the specific resource group.
Use the notScopes (exclusion) property on the policy assignment.
The notScopes property prevents the policy from being evaluated or enforced on specific resource groups, subscriptions, or resources within the assigned scope, satisfying the exemption requirement with zero additional policy definitions.

Anahtar Kavram

Azure Policy effects and assignment scope exclusions
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru