Examkin

Soru

Zorluk: ZorAzure Policy Governance

Solas Energy Systems is designing a governance and compliance strategy for its Azure environment. The resource hierarchy consists of a root management group named Solas-Root, with a child management group named Solas-Prod. Under Solas-Prod, there are multiple subscriptions, including 'Solas-Prod-Sub-02'. You must design an Azure Policy solution that meets the following compliance requirements:

1. All storage accounts deployed under Solas-Prod must use HTTPS only. If a storage account is deployed without HTTPS enabled, Azure Policy must automatically enable it during resource creation.
2. Virtual machines in all subscriptions under Solas-Prod must not be deployed with public IP addresses.
3. Virtual machines in a resource group named 'Legacy-App-RG' under 'Solas-Prod-Sub-02' must be allowed to have public IP addresses to support a legacy telemetry service. However, storage accounts in 'Legacy-App-RG' must still be forced to use HTTPS.
4. The solution must minimize administrative overhead for policy assignment and compliance reporting.

Which design should you recommend?

  1. Create a policy initiative containing a policy definition with the Modify effect for storage accounts and a policy definition with the Deny effect for virtual machine public IPs. Assign the initiative to the Solas-Prod management group. Create a policy exemption targeting the Legacy-App-RG resource group scope for the virtual machine public IP policy definition within the initiative assignment.Cevap
  2. B
    Create a policy initiative containing a policy definition with the Modify effect for storage accounts and a policy definition with the Deny effect for virtual machine public IPs. Assign the initiative to the Solas-Prod management group with the Legacy-App-RG resource group added to the notScopes property of the assignment.
  3. C
    Create a policy initiative containing a policy definition with the DeployIfNotExists effect for storage accounts and a policy definition with the Deny effect for virtual machine public IPs. Assign the initiative to the Solas-Prod management group. Create a policy exemption targeting the Legacy-App-RG resource group scope for the virtual machine public IP policy definition within the initiative assignment.
  4. D
    Create two separate policy assignments at the Solas-Prod management group scope: one for a policy definition with the Deny effect for storage accounts, and one for a policy definition with the Deny effect for virtual machine public IPs. Configure the notScopes property on both assignments to exclude the Legacy-App-RG resource group.

Cevap

The correct design uses a single policy initiative to minimize administrative overhead, configuring the Modify effect for storage accounts, the Deny effect for VM public IPs, and applying a policy exemption to exclude the legacy resource group from the VM public IP policy within the initiative assignment.
The correct design uses a single policy initiative to minimize administrative overhead. The requirement to automatically remediate non-compliant storage accounts is met by the Modify effect, which modifies properties of the resource during creation. The VM public IP block is met by the Deny effect. To exclude only the VM policy for the Legacy-App-RG resource group without excluding it from the storage account policy, a policy exemption is created targeting that specific policy definition within the initiative assignment.

Adım Adım Çözüm

1
Determine the appropriate policy effect for automatically enabling HTTPS on storage accounts.
Modify effect
The Modify effect is used to add or update properties on a resource during creation or update. DeployIfNotExists is for deploying nested resources (like diagnostics), and Deny blocks the resource creation entirely.
2
Determine the appropriate policy effect for blocking public IP creation on VMs.
Deny effect
The Deny effect prevents the resource deployment if it matches the defined non-compliant criteria.
3
Select the grouping mechanism to minimize administrative overhead.
Policy Initiative
Grouping the policy definitions into a single policy initiative allows tracking compliance and managing assignments from a single container.
4
Determine the scoping/exemption mechanism that allows Legacy-App-RG to have public IPs while still enforcing storage HTTPS.
Policy Exemption for the specific definition inside the initiative assignment
Using the notScopes property on the entire initiative assignment would exclude Legacy-App-RG from all policies in the initiative. A policy exemption can target a specific policy definition within the initiative assignment, leaving the storage account policy active.

Anahtar Kavram

Azure Policy effects and scoping mechanisms (Exemptions vs. Exclusions) within Policy Initiatives
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru