AZ-104 Certification Practice Question #81

Question

You have an Azure subscription that contains the hierarchy shown in the following exhibit.

You create an Azure Policy definition named Policy1.
To which Azure resources can you assign Policy1 and which Azure resources can you specify as exclusions from Policy1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

In Azure Policy, a policy definition or initiative can be assigned to any Resource Manager scope that Azure supports, ranging from a management group (including the Tenant Root Group and any child management groups like ManagementGroup1), to subscriptions (Subscription1), resource groups (RG1), and even individual resources (such as VM1). Therefore, you can assign Policy1 to all five resource scopes in the hierarchy. For exclusions, Azure Policy allows you to exclude subscopes (`notScopes`) from a policy assignment to prevent evaluation on specific children. Since Tenant Root Group is the absolute root and cannot be a subscope of any higher-level assignment in this hierarchy, it cannot be configured as an exclusion. Hence, only the child scopes (ManagementGroup1, Subscription1, RG1, and VM1) can be specified as exclusions.

More AZ-104 practice questions