Exam AZ-104 topic 3 question 7 discussion

Y-N-N tested today in a LAB.

N-N-N Policy will identify the VM as not compliant but will not put VM in deallocate

N-N-N Tested in my lab. lots if comments said that you are able to change the address space even with the policy, but it's not possible. The policy prevents you from doing that!

N- restricted by policy N - no changes N - yes, you can make changes on ressources that restricted by policy

Answer should be NNY. The policy don't allow the creation of new resources in RG2 like VM and VNET, but it doesn't affect the already created resources. So 1 and 2 is NO. The number 3 is YES, because the policy doesn't affect the administrator to edit the resources. Nobody can be create a new VNET, but admin can modify existing one.

Answer given is correct. N-Y-N 1. I am given the error Resource 'VNET1' was disallowed by policy 2. Virtual Machine deallocated without an issue 3. Error message: Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy

The correct answers are: 1. No 2. No 3. No When you apply a policy that restricts certain resource types (e.g., Microsoft.Network/virtualNetworks and Microsoft.Compute/virtualMachines), it only prevents the creation of new resources of those types after the policy is enforced. Here's how it affects your existing resources: 1. State of VM1 (existing virtual machine): The existing VM1 will remain unaffected. Azure Policy works as an allow/deny mechanism during the creation or modification of resources. It does not retroactively delete or modify existing resources that were created before the policy was applied. So, VM1 will continue to run normally after the policy is applied. 2. Changing the address space of the VNet: Since the policy prevents actions on Microsoft.Network/virtualNetworks, you would not be able to modify the address space of the existing VNet. The policy will block updates or changes to the VNet because it restricts actions on resources of that type.

Justed tested this in my LAB. The answer is N,N,N Failed to save virtual network changes Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types","id":"/subscriptions/4b52c793-3612-4942-a61f-2caf2d665ccf/resourceGroups/RG2/providers/Microsoft.Authorization/policyAssignments/0fa54e46d93e48dd9c72f3a1"},"policyDefinition":{"name":"Not allowed resource

the answer is N_N_Y since the policy restricts creation of new resources and does not affect the resources that already in the resource group

WRONG No No No

If you are confused about all those comments, The answer is NO, NO, NO, I have just tested on my azure account. When you create the policy, you should give it 10mn at least to show non compliant resources. 1. Resource move policy validation failed. Please see details. Diagnostic information: Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types","id":"/subscriptions/....... 2. The VM still running, I thought that it has restarted but no, it is still running 3. Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types"......

Tried this out. Answer > NYN An Administrator can move VNet1 to RG2 > NO [Error > Resource move policy validation failed. Resource 'VNet1' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types"] The state of VM1 changed to deallocated > YES [ Was able to stop the VM. Was also able to start the VM] An administrator can modify the address space of VNet2 > NO [Error > Failed to save address space changes to virtual network 'VNet2'. Error: Resource 'VNet2' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types"]

N-N-N Tested in lab, A - Cannot add a V-Net to the RG B- the VM's status will not be changed to deallocated C- Cannot modify Address space of V-Net in the RG

NYN is the answer

Correct Answer: N N N

Final Answer : NNY

Yes No Yes