Azure Policy for governance - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of Azure Policy?

Azure Policy helps organizations manage and enforce rules across their cloud resources. What is its main goal?

A To automate deployment of virtual machines only

B To monitor network traffic between resources

C To enforce organizational standards and assess compliance at scale

D To manage user access permissions

💡 Hint

Think about how companies keep their cloud resources following rules and standards.

Azure Policy is designed to enforce rules and ensure resources comply with organizational standards, helping governance and compliance.

❓ Configuration

intermediate

Which JSON snippet correctly denies creation of public IP addresses in Azure Policy?

Identify the Azure Policy rule that blocks creation of public IP addresses.

A { "if": { "field": "type", "equals": "Microsoft.Network/publicIPAddresses" }, "then": { "effect": "deny" } }

B { "if": { "field": "Microsoft.Network/publicIPAddresses", "exists": true }, "then": { "effect": "audit" } }

C { "if": { "field": "type", "equals": "Microsoft.Compute/virtualMachines" }, "then": { "effect": "deny" } }

D { "if": { "field": "type", "notEquals": "Microsoft.Network/publicIPAddresses" }, "then": { "effect": "deny" } }

💡 Hint

Look for the condition that matches the resource type for public IP addresses and denies it.

Option A correctly targets the resource type for public IP addresses and denies their creation.

❓ Architecture

advanced

How should you structure Azure Policy assignments for multiple subscriptions in an organization?

You manage several subscriptions under one Azure tenant. What is the best way to apply policies consistently across all subscriptions?

A Assign policies individually to each subscription

B Assign policies at the management group level containing all subscriptions

C Assign policies only at the resource group level

D Assign policies only to individual resources

💡 Hint

Think about applying rules once to cover many subscriptions efficiently.

Assigning policies at the management group level applies them to all subscriptions within, ensuring consistent governance.

❓ security

advanced

Which Azure Policy effect should you use to monitor non-compliant resources without blocking their creation?

You want to track resources that do not meet policy rules but allow their creation. Which effect fits this need?

A deployIfNotExists

B deny

C append

D audit

💡 Hint

Consider an effect that reports but does not prevent.

The 'audit' effect logs non-compliance but does not block resource creation, enabling monitoring without enforcement.

❓ service_behavior

expert

What happens when an Azure Policy with 'deployIfNotExists' effect is assigned and a non-compliant resource is created?

Explain the behavior triggered by the 'deployIfNotExists' effect in Azure Policy when a resource does not meet the policy condition.

A Azure Policy automatically deploys a related resource to bring compliance

B The policy assignment is ignored for that resource

C The resource is created but marked as non-compliant without any changes

D The resource creation is blocked and an error is shown

💡 Hint

Think about automatic fixes triggered by policy.

'deployIfNotExists' triggers deployment of a resource or configuration to fix non-compliance automatically after resource creation.

Practice

1. What is the main purpose of Azure Policy in cloud governance?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To enforce rules and ensure resources comply with organizational standards

D. To backup data to external storage

Solution

1. Step 1: Understand Azure Policy's role

   Azure Policy is designed to enforce rules on resources to keep them compliant with company rules.

2. Step 2: Compare options to this role

   Only To enforce rules and ensure resources comply with organizational standards describes enforcing rules and compliance, which matches Azure Policy's purpose.

3. Final Answer:

   To enforce rules and ensure resources comply with organizational standards -> Option C

4. Quick Check:

   Azure Policy = Enforce rules [OK]

Hint: Azure Policy controls rules, not resource creation [OK]

Common Mistakes:

• Confusing Azure Policy with Azure Monitor
• Thinking Azure Policy creates resources
• Mixing Azure Policy with backup services

2. Which JSON element is required to specify the action Azure Policy should take when a rule is violated?

easy

A. "effect"

B. "then"

C. "if"

D. "condition"

Solution

1. Step 1: Identify the JSON structure of Azure Policy

   Azure Policy uses "if" to define conditions and "then" to specify what happens, but the specific action is defined by "effect".

2. Step 2: Confirm the element that defines the action

   The "effect" element tells Azure Policy what to do, like deny or audit, when the condition is met.

3. Final Answer:

   "effect" -> Option A

4. Quick Check:

   Action in Azure Policy = effect [OK]

Hint: "effect" defines the action in Azure Policy JSON [OK]

Common Mistakes:

• Confusing "then" with the action element
• Using "condition" instead of "if"
• Missing the "effect" element entirely

3. Given this Azure Policy snippet, what will happen if a storage account is created without encryption enabled?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": false
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The storage account creation will be allowed without encryption

B. The storage account creation will be denied

C. The policy will audit the storage account but allow creation

D. The policy will ignore the encryption setting

Solution

1. Step 1: Analyze the condition in the policy

   The policy checks if encryption.enabled is false (not enabled).

2. Step 2: Understand the effect when condition matches

   The effect is "deny", so if encryption is false, creation is blocked.

3. Final Answer:

   The storage account creation will be denied -> Option B

4. Quick Check:

   Condition false + effect deny = block creation [OK]

Hint: "deny" effect blocks resource creation if condition true [OK]

Common Mistakes:

• Thinking "deny" allows creation but logs it
• Confusing "deny" with "audit" effect
• Ignoring the condition check on encryption

4. You wrote this Azure Policy but it does not block unencrypted storage accounts as expected. What is the error?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": "false"
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The value "false" should be a boolean false, not a string

B. The "effect" should be "audit" instead of "deny"

C. The "field" name is incorrect for encryption

D. The policy is missing a "parameters" section

Solution

1. Step 1: Check the data type of the "equals" value

   The policy uses "equals": "false" which is a string, but encryption.enabled is a boolean.

2. Step 2: Correct the data type to boolean

   Changing "false" (string) to false (boolean) fixes the condition to match properly.

3. Final Answer:

   The value "false" should be a boolean false, not a string -> Option A

4. Quick Check:

   Boolean false, not string "false" fixes policy [OK]

Hint: Use boolean false, not string "false" in conditions [OK]

Common Mistakes:

• Using string "false" instead of boolean false
• Changing effect to audit instead of deny
• Assuming field name is wrong without checking

5. You want to create an Azure Policy that audits virtual machines which do not have a specific tag named "Environment". Which effect should you use to only report non-compliance without blocking resource creation?

hard

A. "deny"

B. "deployIfNotExists"

C. "append"

D. "audit"

Solution

1. Step 1: Understand the requirement to report but not block

   You want to find resources missing the tag but still allow creation.

2. Step 2: Identify the effect that audits without blocking

   The "audit" effect reports non-compliance but does not prevent resource creation.

3. Step 3: Compare other effects

   "deny" blocks creation, "append" adds properties, "deployIfNotExists" deploys resources, none just audit.

4. Final Answer:

   "audit" -> Option D

5. Quick Check:

   Audit effect reports without blocking [OK]

Hint: Use "audit" to report issues without blocking [OK]

Common Mistakes:

• Using "deny" which blocks resource creation
• Confusing "append" with audit
• Choosing "deployIfNotExists" which deploys resources