Azure Policy for governance - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new Azure Policy definition with a display name.

Azure

az policy definition create --name 'policy1' --display-name [1] --rules 'rules.json' --mode All

Drag options to blanks, or click blank then click option'

A"Enforce tag on resources"

B"Create VM"

C"Start VM"

D"Delete resource group"

Attempts:

3 left

💡 Hint

Common Mistakes

Using action names like 'Create VM' instead of a policy description.

Leaving the display name empty.

The --display-name parameter sets the friendly name of the policy. "Enforce tag on resources" is a valid descriptive name.

2fill in blank

medium

Complete the code to assign the policy definition to a subscription.

Azure

az policy assignment create --name 'assign1' --policy [1] --scope /subscriptions/12345678-1234-1234-1234-123456789abc

Drag options to blanks, or click blank then click option'

A"policy1"

B"policyDefinitionId"

C"resourceGroup1"

D"subscription1"

Attempts:

3 left

💡 Hint

Common Mistakes

Using resource group or subscription names instead of the policy name.

Using a placeholder string instead of the actual policy name.

The --policy parameter requires the policy definition name or ID. "policy1" matches the policy created earlier.

3fill in blank

hard

Fix the error in the policy rule JSON snippet to check if a tag named 'environment' exists.

Azure

"if": { "field": "tags.[1]", "exists": true }

Drag options to blanks, or click blank then click option'

Aenv

Benvironment

Ctag

Dlocation

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect or abbreviated tag keys.

Using unrelated fields like 'location'.

The field name must exactly match the tag key. Here, 'environment' is the correct tag key to check.

4fill in blank

hard

Fill both blanks to create a policy rule that denies resource creation if the tag 'costCenter' is missing.

Azure

"if": { "field": "tags.[1]", "exists": [2] }, "then": { "effect": "deny" }

Drag options to blanks, or click blank then click option'

AcostCenter

Btrue

Cfalse

Dlocation

Attempts:

3 left

💡 Hint

Common Mistakes

Setting 'exists' to true instead of false.

Using wrong tag keys.

The policy checks if the tag 'costCenter' does not exist (exists: false) and denies the action.

5fill in blank

hard

Fill all three blanks to create a policy rule that audits virtual machines with a specific SKU.

Azure

"if": { "field": "type", "equals": [1] }, "then": { "effect": [2], "details": { "skuName": [3] } }

Drag options to blanks, or click blank then click option'

A"Microsoft.Compute/virtualMachines"

B"audit"

C"Standard_DS1_v2"

D"deny"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'deny' instead of 'audit' for effect.

Incorrect resource type or SKU name.

The policy audits virtual machines (type), sets the effect to audit, and checks for the SKU Standard_DS1_v2.