SC-100 · Question #155
You have an Azure subscription. Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions. What should you recommend using to enforce…
The correct answer is C. Azure Policy assignments. Azure Policy assignments enforce governance rules such as restricting resource deployment to specific Azure regions. The built-in 'Allowed locations' policy definition prevents resources from being created outside approved regions.
Question
You have an Azure subscription. Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions. What should you recommend using to enforce the governance requirement?
Options
- AAzure management groups
- Bcustom Azure roles
- CAzure Policy assignments
- Dregulatory compliance standards in Microsoft Defender for Cloud
How the community answered
(28 responses)- A4% (1)
- B14% (4)
- C75% (21)
- D7% (2)
Why each option
Azure Policy assignments enforce governance rules such as restricting resource deployment to specific Azure regions. The built-in 'Allowed locations' policy definition prevents resources from being created outside approved regions.
Azure management groups provide a hierarchy for organizing subscriptions and applying policies, but they do not themselves enforce location restrictions without an underlying policy assignment.
Custom Azure roles control which actions (operations) a user can perform, not where resources can be deployed geographically.
Azure Policy provides a built-in policy definition called 'Allowed locations' that, when assigned to a subscription, denies creation of any resource outside the specified regions. Policy assignments are the standard Azure mechanism for enforcing and auditing governance requirements like location restrictions at scale.
Regulatory compliance standards in Defender for Cloud assess existing resources against compliance frameworks but do not prevent or deny the creation of resources in unauthorized locations.
Concept tested: Enforcing allowed Azure regions with Azure Policy
Source: https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#general
Topics
Community Discussion
No community discussion yet for this question.