AZ-500 Question 190
Select 2Your organization requires that all newly created and existing Azure Storage accounts have 'Secure transfer required' enabled. You have created a custom policy that audits whether 'Secure transfer required' is enabled. You also want to group this custom policy with other relevant security-focused policies into a single initiative for consistent governance across multiple subscriptions. After creating the initiative, you plan to assign it at the management group level. Which two steps should you take to properly create, assign, and interpret your Azure policies and initiative? (Choose two.)
- A
Create an initiative definition that includes your custom policy along with other relevant security policies, and then assign that initiative at the management group scope.
- B
Merge your custom policy with the built-in policy by editing the built-in policy definition to include your audit condition.
- C
Review the compliance status and detailed results from the 'Compliance' blade in the Azure Policy service.
- D
Assign each custom policy individually to each subscription and rely on each subscription’s compliance report.
Show answer and explanation
Correct answers: A, C
Explanation
When creating an initiative, you can include one or more policies, making it easier to assign and manage multiple related compliance requirements at scale. Assigning the initiative at the management group level grants consistent governance across all subscriptions within that hierarchy. The compliance results for initiatives and policies can be reviewed in the Azure Policy service’s 'Compliance' blade. For detailed guidance on creating and assigning initiatives, refer to Microsoft Docs: https://learn.microsoft.com/azure/governance/policy/how-to/create-assign-initiative.
- A. Correct.
Option 1 is correct. Creating and assigning an initiative at the management group scope allows you to bundle multiple policies together and apply them consistently across all subscriptions in that management group.
- B. Incorrect.
Option 2 is incorrect. You cannot modify built-in policy definitions directly. Instead, you create a custom policy definition or duplicate a built-in policy to customize it. Merging with the built-in policy is not supported by Azure Policy.
- C. Correct.
Option 3 is correct. Once policies or initiatives are assigned, Azure Policy’s 'Compliance' blade provides visibility into how resources comply with those definitions. This is the recommended method to interpret compliance results.
- D. Incorrect.
Option 4 is incorrect. Assigning custom policies individually at the subscription level duplicates effort and complicates reporting. One of the benefits of a management group assignment is centralized compliance evaluation across multiple subscriptions.