AZ-500 Question 192
Single answerAn organization wants to enforce that all existing and newly created Azure Storage accounts have 'Secure transfer required' set to Enabled. They create a custom Azure Policy definition with an effect of 'Deny' and assign it at the subscription scope. A few weeks later, the security team sees that 10 existing storage accounts are still flagged as non-compliant in Azure Policy. The team wants to understand how to interpret the compliance results and bring the existing non-compliant accounts into alignment. Which action should they take?
- A
Wait for Azure Policy's next compliance scan cycle; it will automatically fix all non-compliant resources over time.
- B
Review the assignment scope in Azure Policy, confirm ‘Storage Account’ resource type is included, and consider using a 'Modify' or 'DeployIfNotExists' effect with a remediation task for existing resources.
- C
Delete and recreate the non-compliant storage accounts; Azure Policy cannot ever update existing resources.
- D
Convert the policy to an Initiative and check each embedded policy individually to auto-remediate existing storage accounts.
Show answer and explanation
Correct answer: B
Explanation
In Azure Policy, a 'Deny' effect blocks the creation or updates of non-compliant resources but does not change existing resources. To remediate existing non-compliant resources, you typically use a 'Modify' or 'DeployIfNotExists' effect together with a remediation task. Reviewing the assignment scope ensures that the policy is applied to the correct resource types and that you can effectively apply remediation for existing resources using Azure Policy.
- A. Incorrect.
Option 1: Incorrect. A 'Deny' policy effect prevents the creation or update of resources that don't meet the policy conditions but does not automatically fix existing resources. Simply waiting won't correct those already non-compliant.
- B. Correct.
Option 2: Correct. Ensuring the correct scope coverage and using a 'Modify' or 'DeployIfNotExists' policy effect, along with creating a remediation task, allows you to update existing resources. 'Deny' on its own only blocks non-compliant changes going forward.
- C. Incorrect.
Option 3: Incorrect. Deleting and recreating resources is a very disruptive approach and is not the only way to achieve compliance. Azure Policy can help update existing resources if the effect and remediation tasks are properly configured.
- D. Incorrect.
Option 4: Incorrect. Turning the policy into an initiative does not automatically fix existing storage accounts. While you can break down multiple child policies in an initiative, you still need the correct policy effect and a remediation task for existing resources.