AZ-104 Question 34
Single answerYour organization requires that all newly deployed Azure resources must include a 'CostCenter' tag. You create a policy definition to enforce this requirement and assign it to a specific resource group. However, resources are still successfully being created in that resource group without the required tag. What is the most likely reason this is happening?
- A
You incorrectly assigned the policy to a subscription scope rather than a resource-group scope.
- B
Your policy definition uses the 'Audit' effect instead of 'Deny.'
- C
You do not have sufficient Role-Based Access Control (RBAC) permissions to assign the policy.
- D
Azure Policy does not support enforcement at the resource-group scope.
Show answer and explanation
Correct answer: B
Explanation
The primary reason resources continue to deploy without the required tag is that the policy only audits rather than denies non-compliant resources. To block creation of resources that fail to meet the tag requirement, the effect must be set to 'Deny' instead of 'Audit.'
- A. Incorrect.
If the policy was assigned at the subscription scope incorrectly, it would still apply to the resource group. This is less likely to be the direct reason resources are deployed without the tag.
- B. Correct.
When a policy is set with the 'Audit' effect, non-compliant resources are noted but not automatically blocked from being created.
- C. Incorrect.
Insufficient RBAC permissions would prevent you from assigning the policy in the first place, but you have already assigned it, so this is unlikely.
- D. Incorrect.
Azure Policy does support assignments at the resource-group level, so this statement is not correct.