Question 780 An enterprise wants to assign several related security policy definitions as one compliance package. Which Azure Policy construct supports this? A VM availability set Create independent role assignments and assume they form a Policy initiative A policy initiative (policy set definition) A Blob container Explanation Correct Answer C:An initiative groups related definitions under a common assignment. Incorrect Answers A:Compute placement doesn't group policy definitions. B:RBAC grants access, whereas an initiative groups related policy definitions for coordinated evaluation. D:Object storage isn't the policy set type.
Question 781 A governance team wants one policy to affect all resource groups inside a subscription. At which scope can it assign the policy? An Azure File Sync cloud endpoint The subscription scope, subject to permissions Only each individual VM's guest operating system Place the rule only in a resource tag instead of a Policy assignment Explanation Correct Answer B:Subscription assignments apply through the supported resource hierarchy. Incorrect Answers A:File sync isn't subscription policy hierarchy. C:Azure Policy evaluates ARM resources at management scopes. D:Tags label resources but do not activate evaluation or enforcement at the selected scope.
Question 782 A multinational company wants one corporate rule across many subscriptions in a management group. Which Policy feature helps? Assign the policy at the management group scope Use a VM Scale Set as the parent of subscriptions Put every subscription into one resource group Duplicate each policy manually in a different VM startup script Explanation Correct Answer A:Policy assignments can inherit to contained subscriptions and their resources. Incorrect Answers B:Compute resources aren't governance parents. C:Resource groups can't contain subscriptions. D:Machine startup actions do not create the required inherited corporate rule at a management-group scope.
Question 783 A VM deployment in a resource group is blocked by an Azure Policy assigned to its parent management group. What explains the behavior? The VM's disk tier caused identity privileges to change Resource groups are separate directories immune to inherited policy Policies can be inherited through management scopes Assume every policy assignment applies beyond its configured scope and exclusions Explanation Correct Answer C:Higher-scope assignments can affect descendant resources. Incorrect Answers A:Disk pricing isn't the policy hierarchy. B:ARM scopes support inheritance. D:Azure Policy follows its management hierarchy and explicit exclusions, not unrelated subscriptions.
Question 784 A critical legacy resource cannot immediately meet one corporate rule, and the governance team approves a bounded exception. What Azure Policy construct is relevant? A policy exemption with an appropriate scope and justification Deleting the policy definition for every subscription Making every staff member Owner Renaming the resource group to Exempt Explanation Correct Answer A:Exemptions can document approved deviations under supported rules. Incorrect Answers B:Global deletion removes unrelated protections. C:Broad RBAC doesn't create a documented compliant exception. D:A name isn't a policy exemption object.
Question 785 A security officer needs a current summary of how resources satisfy assigned Azure Policy rules. Which tool view is appropriate? A VM data disk snapshot Azure Policy compliance results at the intended scope Treat a successful deployment message as proof of every resource's current policy compliance Only an App Service deployment slot list Explanation Correct Answer B:Compliance views identify assessed resources and noncompliant states. Incorrect Answers A:Snapshots are not policy assessment summaries. C:Deployment status and policy compliance reporting measure different things. D:Slots don't report cross-resource compliance.
Question 786 A new Azure Policy is assigned to an existing subscription with hundreds of deployed resources. What should operators expect? Assume an Audit policy automatically changes every existing noncompliant resource Every legacy resource is instantly deleted if noncompliant Existing resources may be evaluated for compliance, while remediation depends on effect and configuration A policy assignment never evaluates deployed resources Explanation Correct Answer C:Assignment doesn't automatically rewrite every resource under every effect. Incorrect Answers A:Audit generally reports findings rather than remediating each resource without an appropriate effect and remediation process. B:Policy effects aren't a universal destructive cleanup mechanism. D:Compliance assessment can include existing resources.
Question 787 An audit finds resources missing a required setting that a supported policy can deploy or modify. What extra operation may be needed for existing resources? Enlarge every VM OS disk A remediation task with the correct managed identity permissions Only a portal bookmark for the policy screen Set the resource tag PolicyFixed manually without validating state Explanation Correct Answer B:Existing resources may require explicit remediation for modify or deployIfNotExists effects. Incorrect Answers A:Disk size isn't a universal remediation. C:A bookmark doesn't apply changes. D:Text alone doesn't apply the missing configuration.
Question 788 A newly assigned Azure Policy hasn't yet shown every existing resource in compliance results. What operational factor may explain this? Policy definitions are never evaluated after creation Storage hot tier determines policy scanning time exclusively An Azure region pair instantly calculates all policy results Policy evaluation timing and triggered compliance scans Explanation Correct Answer D:Compliance data may take time to reflect the latest assignment and resources. Incorrect Answers A:Evaluation occurs under supported triggers. B:Blob tiers aren't the Policy evaluation engine. C:Regional topology doesn't guarantee zero-delay evaluation.
Question 789 A subscription Contributor is blocked from creating a disallowed public IP. What is the most accurate interpretation? Contributor automatically overrides all deny policies A public IP cannot ever be created in Azure Assume a policy assignment grants the operator the Azure RBAC rights needed for exceptions Azure RBAC allows deployment actions, but Azure Policy can still deny specific noncompliant configurations Explanation Correct Answer D:Authorization and compliance enforcement work together. Incorrect Answers A:Role power does not generally bypass assigned policy. B:The block is scoped by the assigned rule. C:Policy scope governs evaluation, while role assignments govern whether the principal can modify exemptions.
Question 790 One resource complies with a resource-group policy but violates a management-group policy. What should governance review? Only a storage account key All applicable policy assignments inherited or directly scoped to the resource Only the resource group's newest display name Only the VM guest OS version Explanation Correct Answer B:Compliance is affected by more than the nearest assignment. Incorrect Answers A:Storage credentials aren't the hierarchy of policies. C:Naming doesn't reveal all inherited assignments. D:Guest OS may not explain an ARM location rule.
