SC-100 Question #63: Real Exam Question with Answer & Explanation

The correct answer is B: Disabled. It has to be disabled since deny will send the compliance report as non-complaint. This effect is useful for testing situations or for when the policy definition has parameterized the effect. This flexibility makes it possible to disable a single assignment instead of disabling a

Design security operations, identity, and compliance capabilities

Question

You are evaluating an Azure environment for compliance. You need to design an Azure Policy implementation that can be used to evaluate compliance without changing any resources. Which effect should you use in Azure Policy?

Options

ADeny
BDisabled
CModify
DAppend

Explanation

It has to be disabled since deny will send the compliance report as non-complaint. This effect is useful for testing situations or for when the policy definition has parameterized the effect. This flexibility makes it possible to disable a single assignment instead of disabling all of that policy's assignments. An alternative to the Disabled effect is enforcementMode, which is set on the policy assignment. When enforcementMode is Disabled, resources are still evaluated. https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#disabled

Topics

#Azure Policy#Compliance Evaluation#Policy Effects#Resource Governance

Community Discussion

No community discussion yet for this question.

Full SC-100 Practice Browse All SC-100 Questions