nerdexam
Microsoft

SC-100 · Question #155

You have an Azure subscription. Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions. What should you recommend using to enforce…

The correct answer is C. Azure Policy assignments. Azure Policy assignments enforce governance rules such as restricting resource deployment to specific Azure regions. The built-in 'Allowed locations' policy definition prevents resources from being created outside approved regions.

Design security operations, identity, and compliance capabilities

Question

You have an Azure subscription. Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions. What should you recommend using to enforce the governance requirement?

Options

  • AAzure management groups
  • Bcustom Azure roles
  • CAzure Policy assignments
  • Dregulatory compliance standards in Microsoft Defender for Cloud

How the community answered

(28 responses)
  • A
    4% (1)
  • B
    14% (4)
  • C
    75% (21)
  • D
    7% (2)

Why each option

Azure Policy assignments enforce governance rules such as restricting resource deployment to specific Azure regions. The built-in 'Allowed locations' policy definition prevents resources from being created outside approved regions.

AAzure management groups

Azure management groups provide a hierarchy for organizing subscriptions and applying policies, but they do not themselves enforce location restrictions without an underlying policy assignment.

Bcustom Azure roles

Custom Azure roles control which actions (operations) a user can perform, not where resources can be deployed geographically.

CAzure Policy assignmentsCorrect

Azure Policy provides a built-in policy definition called 'Allowed locations' that, when assigned to a subscription, denies creation of any resource outside the specified regions. Policy assignments are the standard Azure mechanism for enforcing and auditing governance requirements like location restrictions at scale.

Dregulatory compliance standards in Microsoft Defender for Cloud

Regulatory compliance standards in Defender for Cloud assess existing resources against compliance frameworks but do not prevent or deny the creation of resources in unauthorized locations.

Concept tested: Enforcing allowed Azure regions with Azure Policy

Source: https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#general

Topics

#Azure Policy#Governance#Region restrictions#Compliance enforcement

Community Discussion

No community discussion yet for this question.

Full SC-100 Practice