Azure Policy for governance - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new Azure Policy definition with a display name.

Azure

az policy definition create --name 'policy1' --display-name [1] --rules 'rules.json' --mode All

Drag options to blanks, or click blank then click option'

A"Enforce tag on resources"

B"Create VM"

C"Start VM"

D"Delete resource group"

Attempts:

3 left

💡 Hint

Common Mistakes

Using action names like 'Create VM' instead of a policy description.

Leaving the display name empty.

The --display-name parameter sets the friendly name of the policy. "Enforce tag on resources" is a valid descriptive name.

2fill in blank

medium

Complete the code to assign the policy definition to a subscription.

Azure

az policy assignment create --name 'assign1' --policy [1] --scope /subscriptions/12345678-1234-1234-1234-123456789abc

Drag options to blanks, or click blank then click option'

A"policy1"

B"policyDefinitionId"

C"resourceGroup1"

D"subscription1"

Attempts:

3 left

💡 Hint

Common Mistakes

Using resource group or subscription names instead of the policy name.

Using a placeholder string instead of the actual policy name.

The --policy parameter requires the policy definition name or ID. "policy1" matches the policy created earlier.

3fill in blank

hard

Fix the error in the policy rule JSON snippet to check if a tag named 'environment' exists.

Azure

"if": { "field": "tags.[1]", "exists": true }

Drag options to blanks, or click blank then click option'

Aenv

Benvironment

Ctag

Dlocation

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect or abbreviated tag keys.

Using unrelated fields like 'location'.

The field name must exactly match the tag key. Here, 'environment' is the correct tag key to check.

4fill in blank

hard

Fill both blanks to create a policy rule that denies resource creation if the tag 'costCenter' is missing.

Azure

"if": { "field": "tags.[1]", "exists": [2] }, "then": { "effect": "deny" }

Drag options to blanks, or click blank then click option'

AcostCenter

Btrue

Cfalse

Dlocation

Attempts:

3 left

💡 Hint

Common Mistakes

Setting 'exists' to true instead of false.

Using wrong tag keys.

The policy checks if the tag 'costCenter' does not exist (exists: false) and denies the action.

5fill in blank

hard

Fill all three blanks to create a policy rule that audits virtual machines with a specific SKU.

Azure

"if": { "field": "type", "equals": [1] }, "then": { "effect": [2], "details": { "skuName": [3] } }

Drag options to blanks, or click blank then click option'

A"Microsoft.Compute/virtualMachines"

B"audit"

C"Standard_DS1_v2"

D"deny"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'deny' instead of 'audit' for effect.

Incorrect resource type or SKU name.

The policy audits virtual machines (type), sets the effect to audit, and checks for the SKU Standard_DS1_v2.

Practice

1. What is the main purpose of Azure Policy in cloud governance?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To enforce rules and ensure resources comply with organizational standards

D. To backup data to external storage

Solution

1. Step 1: Understand Azure Policy's role

   Azure Policy is designed to enforce rules on resources to keep them compliant with company rules.

2. Step 2: Compare options to this role

   Only To enforce rules and ensure resources comply with organizational standards describes enforcing rules and compliance, which matches Azure Policy's purpose.

3. Final Answer:

   To enforce rules and ensure resources comply with organizational standards -> Option C

4. Quick Check:

   Azure Policy = Enforce rules [OK]

Hint: Azure Policy controls rules, not resource creation [OK]

Common Mistakes:

• Confusing Azure Policy with Azure Monitor
• Thinking Azure Policy creates resources
• Mixing Azure Policy with backup services

2. Which JSON element is required to specify the action Azure Policy should take when a rule is violated?

easy

A. "effect"

B. "then"

C. "if"

D. "condition"

Solution

1. Step 1: Identify the JSON structure of Azure Policy

   Azure Policy uses "if" to define conditions and "then" to specify what happens, but the specific action is defined by "effect".

2. Step 2: Confirm the element that defines the action

   The "effect" element tells Azure Policy what to do, like deny or audit, when the condition is met.

3. Final Answer:

   "effect" -> Option A

4. Quick Check:

   Action in Azure Policy = effect [OK]

Hint: "effect" defines the action in Azure Policy JSON [OK]

Common Mistakes:

• Confusing "then" with the action element
• Using "condition" instead of "if"
• Missing the "effect" element entirely

3. Given this Azure Policy snippet, what will happen if a storage account is created without encryption enabled?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": false
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The storage account creation will be allowed without encryption

B. The storage account creation will be denied

C. The policy will audit the storage account but allow creation

D. The policy will ignore the encryption setting

Solution

1. Step 1: Analyze the condition in the policy

   The policy checks if encryption.enabled is false (not enabled).

2. Step 2: Understand the effect when condition matches

   The effect is "deny", so if encryption is false, creation is blocked.

3. Final Answer:

   The storage account creation will be denied -> Option B

4. Quick Check:

   Condition false + effect deny = block creation [OK]

Hint: "deny" effect blocks resource creation if condition true [OK]

Common Mistakes:

• Thinking "deny" allows creation but logs it
• Confusing "deny" with "audit" effect
• Ignoring the condition check on encryption

4. You wrote this Azure Policy but it does not block unencrypted storage accounts as expected. What is the error?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": "false"
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The value "false" should be a boolean false, not a string

B. The "effect" should be "audit" instead of "deny"

C. The "field" name is incorrect for encryption

D. The policy is missing a "parameters" section

Solution

1. Step 1: Check the data type of the "equals" value

   The policy uses "equals": "false" which is a string, but encryption.enabled is a boolean.

2. Step 2: Correct the data type to boolean

   Changing "false" (string) to false (boolean) fixes the condition to match properly.

3. Final Answer:

   The value "false" should be a boolean false, not a string -> Option A

4. Quick Check:

   Boolean false, not string "false" fixes policy [OK]

Hint: Use boolean false, not string "false" in conditions [OK]

Common Mistakes:

• Using string "false" instead of boolean false
• Changing effect to audit instead of deny
• Assuming field name is wrong without checking

5. You want to create an Azure Policy that audits virtual machines which do not have a specific tag named "Environment". Which effect should you use to only report non-compliance without blocking resource creation?

hard

A. "deny"

B. "deployIfNotExists"

C. "append"

D. "audit"

Solution

1. Step 1: Understand the requirement to report but not block

   You want to find resources missing the tag but still allow creation.

2. Step 2: Identify the effect that audits without blocking

   The "audit" effect reports non-compliance but does not prevent resource creation.

3. Step 3: Compare other effects

   "deny" blocks creation, "append" adds properties, "deployIfNotExists" deploys resources, none just audit.

4. Final Answer:

   "audit" -> Option D

5. Quick Check:

   Audit effect reports without blocking [OK]

Hint: Use "audit" to report issues without blocking [OK]

Common Mistakes:

• Using "deny" which blocks resource creation
• Confusing "append" with audit
• Choosing "deployIfNotExists" which deploys resources