Examkin

Soru

Zorluk: ZorAzure Policy Governance

An organization, Zenith Retail, is designing an Azure governance strategy. The resource hierarchy consists of a root management group named Zenith-Root, with a child management group named Prod-MG containing all production subscriptions.

You must design an Azure Policy solution assigned at the Prod-MG level to meet the following requirements:
1. All virtual machines must have the Azure Monitor Agent installed and configured. Non-compliant virtual machines must be automatically configured upon deployment.
2. All new resource groups must automatically have a cost-center tag (CostCenter: 4002) applied if they are created without one, without blocking deployment.
3. No public IP addresses may be deployed within the subscriptions under Prod-MG, except for a specific shared services resource group named Shared-Gateway-RG where public IPs are permitted for firewalls.

Which two of the following design actions should the cloud architect implement to meet these requirements while minimizing administrative overhead?

  1. Create and assign a policy initiative at the Prod-MG scope that contains a policy definition using the DeployIfNotExists effect to install the Azure Monitor Agent and a policy definition using the Modify effect to append the cost-center tag.Cevap
  2. Assign a policy definition using the Deny effect for public IP resources at the Prod-MG scope, and configure the resource ID of Shared-Gateway-RG within the notScopes (exclusions) property of the policy assignment.Cevap
  3. C
    Assign a policy definition using the Deny effect for virtual machines lacking the Azure Monitor Agent at the Prod-MG scope, and configure an Azure Event Grid subscription to trigger an Azure Function that installs the agent.
  4. D
    Assign a policy definition using the Audit effect for missing resource group tags at the Prod-MG scope, and use a scheduled Azure Automation runbook to apply the tags to non-compliant resource groups.

Cevap

Assign a policy initiative at the Prod-MG scope containing a DeployIfNotExists policy for the agent and a Modify policy for the tags, and assign a Deny policy for public IPs at the Prod-MG scope with Shared-Gateway-RG specified in the notScopes property.
To satisfy the requirements with minimal administrative overhead, the architect should group the agent installation policy (which requires DeployIfNotExists to remediate missing agents) and the tagging policy (which requires Modify to apply missing tags without blocking deployments) into a single policy initiative assigned at the Prod-MG management group level. Additionally, preventing public IP creation globally while exempting a specific resource group is best handled by assigning a Deny policy at the management group level and using the notScopes property of the policy assignment to exclude the gateway resource group.

Adım Adım Çözüm

1
Analyze compliance requirements for virtual machine monitoring configuration.
Identified the need to automatically configure virtual machines with the Azure Monitor Agent upon deployment. This corresponds to the DeployIfNotExists (DINE) policy effect, which remediates non-compliant resources natively.
DeployIfNotExists allows resources to be deployed and then automatically configures the missing extension, preventing deployment blockages while ensuring compliance.
2
Analyze compliance requirements for resource group cost-center tagging.
Identified the need to automatically append the CostCenter tag without blocking deployment if the tag is missing. This corresponds to the Modify policy effect.
The Modify effect can add, update, or remove properties/tags on a resource during the creation or update lifecycle phase without blocking the resource manager deployment.
3
Determine the optimal policy grouping and assignment scope to minimize overhead.
Combine the DeployIfNotExists policy and the Modify policy into a single policy initiative (set definition) and assign it at the Prod-MG management group level.
Initiatives simplify policy management by grouping multiple definitions together, reducing the number of individual assignments that need to be tracked at the management group scale.
4
Analyze restriction requirements for public IP addresses and exemptions.
Identified that public IPs must be blocked except in Shared-Gateway-RG. This corresponds to a Deny policy assigned at Prod-MG, with the Shared-Gateway-RG resource ID configured in the notScopes property.
The Deny effect prevents resource creation if it violates the policy. Using the notScopes property allows a clean exemption for the specific resource group without requiring separate assignments or policy rules.

Anahtar Kavram

Azure Policy Effects and Governance Architecture
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru