AZ-104 · Question #787
AZ-104 Question #787: Real Exam Question with Answer & Explanation
The correct answer is D: an Azure Resource Manager (ARM) template. The only way to create a deny assignment is through Azure blueprints, and this can only be done when the resource is created. The resource locks protecting against other subscription Owners cannot be applied to existing resources, only new ones. Deny assignments block users from
Question
You have an Azure subscription. You plan to create a storage account named storage1. You need to configure a deny assignment for storage1. What should you use?
Options
- AAzure Policy
- Ba landing zone
- Ca deployment stack
- Dan Azure Resource Manager (ARM) template
Explanation
The only way to create a deny assignment is through Azure blueprints, and this can only be done when the resource is created. The resource locks protecting against other subscription Owners cannot be applied to existing resources, only new ones. Deny assignments block users from performing specific Azure resource actions even if a role assignment grants them access. But you need add this protection in the blueprint definitions of resources created by an Azure Resource Manager template artifact, and the Blueprint resource lock is set during blueprint assignment. https://learn.microsoft.com/en-us/answers/questions/1108981/deny-assignment
Community Discussion
No community discussion yet for this question.