nerdexam
Microsoft

AZ-500 · Question #378

Hotspot Question You have an Azure subscription that contains a resource group named RG1. RG1 contains a virtual machine named VM1 that uses Azure Active Directory (Azure AD) authentication. You…

The correct answer is SQL1 will have TDE enabled automatically. = No; The deployment of SQL2 will fail. = Yes; SQL3 will be deployed and marked as noncompliant. = Yes. This question tests understanding of Azure Policy effects and how they interact with resource deployments. The 'DeployIfNotExists' effect automatically remediates non-compliant resources (like enabling TDE), but it requires a remediation task to be triggered - it does NOT…

Submitted by yasin.bd· Mar 6, 2026Manage Azure identities and governance - specifically implementing and managing Azure Policy effects (Audit, Deny, DeployIfNotExists) and understanding how custom RBAC roles interact with policy enforcement on resource groups.

Question

Hotspot Question You have an Azure subscription that contains a resource group named RG1. RG1 contains a virtual machine named VM1 that uses Azure Active Directory (Azure AD) authentication. You have two custom Azure roles named Role1 and Role2 that are scoped to RG1. The permissions for Role1 are shown in the following JSON code. The permissions for Role2 are shown in the following JSON code. You assign the roles to the users shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #378 exhibit 1
AZ-500 question #378 exhibit 2
AZ-500 question #378 exhibit 3
AZ-500 question #378 exhibit 4

Answer Area

  • SQL1 will have TDE enabled automatically.No
  • The deployment of SQL2 will fail.Yes
  • SQL3 will be deployed and marked as noncompliant.Yes

Explanation

This question tests understanding of Azure Policy effects and how they interact with resource deployments. The 'DeployIfNotExists' effect automatically remediates non-compliant resources (like enabling TDE), but it requires a remediation task to be triggered - it does NOT happen automatically at deployment time for existing resources, so SQL1 will NOT have TDE enabled automatically. The 'Deny' effect blocks deployments that violate policy, so SQL2 (which violates the policy) will fail to deploy. The 'Audit' effect allows deployment but flags the resource as non-compliant in the compliance dashboard, so SQL3 will deploy successfully but appear as non-compliant.

Topics

#Azure Policy#Policy Effects#RBAC#Compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice