Policy assignments and compliance in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Azure Policy Assignment Scope

In Azure, when you assign a policy, you must specify the scope. Which of the following scopes is not valid for a policy assignment?

A A resource group

B A subscription

C A management group

D An individual virtual machine instance

💡 Hint

Think about the levels at which Azure policies can be applied.

Azure policies can be assigned at management group, subscription, or resource group levels. Individual resources like a single VM cannot be a direct scope for policy assignment.

❓ service_behavior

intermediate

Effect of a Deny Policy on Resource Creation

You have an Azure policy assigned with the effect set to Deny for creating storage accounts in a specific region. What happens when a user tries to create a storage account in that region?

A The creation request is blocked and the storage account is not created.

B The storage account is created but marked as non-compliant.

C The storage account is created and a warning is sent to the administrator.

D The storage account is created but with limited features.

💡 Hint

Consider what the Deny effect means in Azure Policy.

The Deny effect blocks the request to create or update resources that do not comply with the policy. So, the storage account creation is blocked.

❓ Architecture

advanced

Designing Policy Compliance Reporting

You want to design a solution to monitor compliance of multiple subscriptions under a management group using Azure Policy. Which approach will provide a centralized compliance report for all subscriptions?

A Assign policies at the management group level and use Azure Policy compliance dashboard at management group scope.

B Use Azure Monitor logs to track compliance without assigning policies.

C Assign policies individually to each subscription and check compliance per subscription.

D Assign policies at the resource group level and aggregate reports manually.

💡 Hint

Think about how Azure Policy inheritance works and where compliance data is aggregated.

Assigning policies at the management group level applies them to all subscriptions under it, and the compliance dashboard at that scope shows aggregated compliance data.

❓ security

advanced

Impact of Policy Exemptions on Compliance

You have a policy assigned to a subscription that restricts public IP addresses. You create an exemption for a specific resource group. What is the impact of this exemption on compliance reporting?

A The exemption disables the policy for the entire subscription.

B Resources in the exempted resource group are excluded from compliance evaluation for that policy.

C The exemption causes all resources to be marked non-compliant.

D The exemption only applies to new resources created after the exemption is set.

💡 Hint

Consider how policy exemptions affect compliance evaluation scope.

Policy exemptions exclude specified scopes from compliance evaluation, so resources in the exempted resource group are not evaluated against that policy.

✅ Best Practice

expert

Optimizing Policy Assignments for Large Environments

In a large Azure environment with hundreds of subscriptions, what is the best practice to efficiently manage and enforce policies while minimizing administrative overhead?

A Assign policies only at the resource group level to limit scope.

B Assign policies individually to each subscription to maintain granular control.

C Use management groups to assign policies at higher levels and leverage inheritance.

D Avoid using Azure Policy and rely on manual audits.

💡 Hint

Think about how Azure Policy inheritance and management groups help scale policy management.

Using management groups allows centralized policy assignments that automatically apply to all child subscriptions, reducing repetitive work and ensuring consistency.