Azure Policy for governance - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of Azure Policy?

Azure Policy helps organizations manage and enforce rules across their cloud resources. What is its main goal?

A To automate deployment of virtual machines only

B To monitor network traffic between resources

C To enforce organizational standards and assess compliance at scale

D To manage user access permissions

💡 Hint

Think about how companies keep their cloud resources following rules and standards.

Azure Policy is designed to enforce rules and ensure resources comply with organizational standards, helping governance and compliance.

❓ Configuration

intermediate

Which JSON snippet correctly denies creation of public IP addresses in Azure Policy?

Identify the Azure Policy rule that blocks creation of public IP addresses.

A { "if": { "field": "type", "equals": "Microsoft.Network/publicIPAddresses" }, "then": { "effect": "deny" } }

B { "if": { "field": "Microsoft.Network/publicIPAddresses", "exists": true }, "then": { "effect": "audit" } }

C { "if": { "field": "type", "equals": "Microsoft.Compute/virtualMachines" }, "then": { "effect": "deny" } }

D { "if": { "field": "type", "notEquals": "Microsoft.Network/publicIPAddresses" }, "then": { "effect": "deny" } }

💡 Hint

Look for the condition that matches the resource type for public IP addresses and denies it.

Option A correctly targets the resource type for public IP addresses and denies their creation.

❓ Architecture

advanced

How should you structure Azure Policy assignments for multiple subscriptions in an organization?

You manage several subscriptions under one Azure tenant. What is the best way to apply policies consistently across all subscriptions?

A Assign policies individually to each subscription

B Assign policies at the management group level containing all subscriptions

C Assign policies only at the resource group level

D Assign policies only to individual resources

💡 Hint

Think about applying rules once to cover many subscriptions efficiently.

Assigning policies at the management group level applies them to all subscriptions within, ensuring consistent governance.

❓ security

advanced

Which Azure Policy effect should you use to monitor non-compliant resources without blocking their creation?

You want to track resources that do not meet policy rules but allow their creation. Which effect fits this need?

A deployIfNotExists

B deny

C append

D audit

💡 Hint

Consider an effect that reports but does not prevent.

The 'audit' effect logs non-compliance but does not block resource creation, enabling monitoring without enforcement.

❓ service_behavior

expert

What happens when an Azure Policy with 'deployIfNotExists' effect is assigned and a non-compliant resource is created?

Explain the behavior triggered by the 'deployIfNotExists' effect in Azure Policy when a resource does not meet the policy condition.

A Azure Policy automatically deploys a related resource to bring compliance

B The policy assignment is ignored for that resource

C The resource is created but marked as non-compliant without any changes

D The resource creation is blocked and an error is shown

💡 Hint

Think about automatic fixes triggered by policy.

'deployIfNotExists' triggers deployment of a resource or configuration to fix non-compliance automatically after resource creation.