Examkin

Soru

Zorluk: OrtaAzure Policy Governance

Apex Pharma has a multi-subscription Azure environment. The security team has the following compliance requirements for all resources in a production subscription:
1. Automatically apply a tag named 'SecurityReview' with the value 'Approved' to all newly created resource groups, without blocking the deployment if the tag is missing in the request.
2. Block the deployment of virtual machines that do not use Premium SSD storage, except for those deployed within a specific development resource group.

You need to design an Azure Policy solution to meet the requirements with the least administrative effort.

Which two of the following actions should you perform? (Select two)

  1. Create a policy definition with the Modify effect and assign it to the production subscription to add the 'SecurityReview' tag.Cevap
  2. Create a policy definition with the Deny effect, assign it to the production subscription, and add the development resource group to the assignment exclusions.Cevap
  3. C
    Create a policy definition with the DeployIfNotExists effect to automatically deploy the 'SecurityReview' tag to resource groups.
  4. D
    Create a policy definition with the Audit effect to log non-compliant virtual machines and configure a daily manual remediation task.

Cevap

To meet the requirements, you should create a policy definition with the Modify effect to add the 'SecurityReview' tag, and create a policy definition with the Deny effect while adding the development resource group to the assignment exclusions.
The correct design uses the Modify effect to add the tag during resource creation without blocking the deployment request, and the Deny effect to block non-compliant VM deployments while exempting the development resource group by adding it to the policy assignment's excluded scopes.

Adım Adım Çözüm

1
Analyze the tag requirement.
The requirement is to automatically apply a tag without blocking the deployment. The Modify effect is used to add, update, or remove properties/tags on resources during creation or update.
To select the correct policy effect for tagging.
2
Analyze the virtual machine storage requirement.
The requirement is to block the creation of non-compliant virtual machines. The Deny effect blocks the resource creation request if it does not match the policy rule.
To select the correct policy effect for enforcement.
3
Analyze the exclusion requirement.
The exclusion of a specific development resource group from the Deny policy can be achieved by adding the resource group's resource ID to the excluded scopes (notScopes) of the policy assignment.
To exempt specific resources from policy enforcement.

Anahtar Kavram

Azure Policy effects and assignment exclusions
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru