Examkin

Soru

Zorluk: OrtaAzure Policy Governance

An organization named CloudVibe is designing a governance strategy for its Azure subscriptions. The subscriptions are organized under a single management group named CloudVibe-MG.

The organization has the following compliance and security requirements:
- Automatically enable Azure Backup for all new virtual machines deployed to the production subscription. If a virtual machine is deployed without a backup configuration, the backup must be configured automatically without manual intervention.
- Prevent developers from creating public IP addresses in the development subscription.

You need to recommend the Azure Policy configurations to meet these requirements.

Which two policy configurations should you include in the design?

  1. An Azure Policy assignment at the production subscription scope using a policy definition with the DeployIfNotExists effect to enable backup.Cevap
  2. B
    An Azure Policy assignment at the production subscription scope using a policy definition with the Modify effect to enable backup.
  3. An Azure Policy assignment at the development subscription scope using a policy definition with the Deny effect to block public IP addresses.Cevap
  4. D
    An Azure Policy assignment at the development subscription scope using a policy definition with the Audit effect to flag public IP addresses.

Cevap

The correct configurations are to assign a policy definition with the DeployIfNotExists effect to the production subscription to enable backup, and to assign a policy definition with the Deny effect to the development subscription to block public IP addresses.
The correct answer combines DeployIfNotExists for automated backup deployment and Deny to block the creation of public IP addresses. DeployIfNotExists evaluates a resource and deploys a template (like a backup association) if it is missing, satisfying the first requirement. The Deny effect blocks the creation or update of resources that do not match the policy criteria, satisfying the second requirement to prevent public IP address creation in the development subscription.

Adım Adım Çözüm

1
Analyze the backup requirement.
The requirement specifies that Azure Backup must be enabled automatically if a VM is deployed without it, with no manual intervention. This implies automatic remediation.
Automatic remediation of missing resource configurations requires the DeployIfNotExists (DINE) effect, which deploys the required backup configuration resource. The Modify effect can only alter resource fields/tags but cannot perform resource deployments.
2
Analyze the public IP prevention requirement.
The requirement states that developers must be prevented from creating public IP addresses in the development subscription.
To block or prevent the creation of non-compliant resources, the Deny effect is the correct choice. The Audit effect only flags non-compliance after deployment but does not block the creation.
3
Select the correct scopes for the policy assignments.
Assign the DeployIfNotExists backup policy to the production subscription, and the Deny public IP policy to the development subscription.
Targeting the specific subscription scopes ensures that the policies only apply to their respective environments without affecting other subscriptions under the management group.

Anahtar Kavram

Azure Policy effects (DeployIfNotExists and Deny) are used to enforce compliance by automatically remediating missing configurations or blocking the creation of prohibited resources.
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru