AZ-500 Question 188
Select 2Your organization mandates that all new Azure Storage accounts must follow a naming standard beginning with 'corp' followed by a unique identifier. You are tasked with enforcing this requirement using Azure Policy to ensure any non-compliant storage account is blocked during creation. Which two tasks should you perform to meet this requirement?
- A
Create a custom policy definition that checks the name property of the storage account resource and uses the 'Deny' effect.
- B
Assign the custom policy definition at the appropriate scope (subscription or resource group).
- C
Configure an Azure Resource Lock at the subscription level to prevent non-compliant deployments.
- D
Use a 'DeployIfNotExist' policy to automatically rename non-compliant storage accounts.
Show answer and explanation
Correct answers: A, B
Explanation
To enforce naming standards for newly created resources, you must define a policy that checks resource property values and uses a 'Deny' effect to block non-compliant deployments. Assigning this policy to the correct scope (subscription or resource group) ensures that any resource created in that scope must comply with the naming rule. For more details, refer to the Azure Policy documentation at https://learn.microsoft.com/azure/governance/policy/overview.
- A. Correct.
Correct. A custom policy definition is needed to specifically check the name property of storage accounts. The 'Deny' effect will block any deployment that doesn't meet the naming convention.
- B. Correct.
Correct. After creating the policy definition, you must assign it to the relevant scope, this could be a resource group or subscription, to ensure it is enforced during resource creation.
- C. Incorrect.
Incorrect. Resource Locks are designed to prevent deletion or modification, not to enforce naming standards during resource creation.
- D. Incorrect.
Incorrect. 'DeployIfNotExist' cannot rename a resource; it can only deploy helper resources or configurations if they do not exist. Also, the requirement is to deny non-compliant names, not fix them automatically.