AZ-500 · Question #472
You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table. You create and assign the Azure policy shown in the…
The correct answer is D. Flow logs will be disabled for NSG1 and NSG2. Given that the Azure policy is assigned and the correct answer is that flow logs will be disabled for both NSGs, the policy must be configured to disable network security group flow logging.
Question
Options
- AFlow logs will be enabled for NSG1 only.
- BFlow logs will be enabled for NSG2 only.
- CFlow logs will be enabled for NSG1 and NSG2.
- DFlow logs will be disabled for NSG1 and NSG2.
How the community answered
(25 responses)- A12% (3)
- B4% (1)
- C8% (2)
- D76% (19)
Why each option
Given that the Azure policy is assigned and the correct answer is that flow logs will be disabled for both NSGs, the policy must be configured to disable network security group flow logging.
This is incorrect because an Azure Policy's effect applies consistently to all resources within its scope that meet the conditions, not just a single NSG.
This is incorrect because an Azure Policy's effect applies consistently to all resources within its scope that meet the conditions, not just a single NSG.
This is incorrect if the policy's intended effect, as indicated by the correct answer, is to disable flow logs rather than enable them.
If the assigned Azure Policy is configured to disable network security group flow logging, then its enforcement within the policy's scope will result in flow logs being disabled for all targeted NSGs, including NSG1 and NSG2.
Concept tested: Azure Policy effect on Network Security Group flow logs
Source: https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview#network-security-group-flow-logs
Community Discussion
No community discussion yet for this question.