Exam AZ-104 topic 2 question 7 discussion

Correct answer is: VNET1 will only have Department: D1 tag & VNET 2 will only have Label : Value1 tag

resources created before policy creation will not inherit the policy rules. so, VNET1 will only have Department: D1 tag, VNET 2 will have Label : Value1

VNET1: Inherits the policy tag (Label: Value1) Keeps its existing tag (Department: D1) Inherits the direct tag applied to RG6 (RGroup: RG6) Tags: Department: D1, RGroup: RG6, Label: Value1 VNET2: Inherits the policy tag (Label: Value1) Inherits the direct tag applied to RG6 (RGroup: RG6) Tags: RGroup: RG6, Label: Value1

This is really easy to test. What came out of doing this for real (in the specific order that the question poses) with the policy "APPEND tag and its default value" is Vnet1 has only Department:D1, and Vnet2 has only Label:Value1. The text of the policy in the question does not match what is available in the policies in real life (append vs apply). In any case, here are the take-aways: Applying a tag to the resource group itself has no bearing on what the resources in the RG group get tagged with. Direct resource group tags are not inherited by resources in the group. Existing resources do not get the tagging applied when the policy is applied. Subsequent resources added after the policy is applied do get the tagging applied. It appears possible to create a policy that would create the tags on existing resources, but it requires usage of a managed identity; presumably this managed identity would be given access to modify the resources (as necessary to add and/or reset a tag+value).

VNET1: Department: D1, and Label:Value1 only. VNET2: Label:Value1 only. Above answers are correct. Reason in simple wording - 1ST - Tags are not inherited to resources from Resource groups. But for first scenario there was no tag assigned to RG6 rather a Azure policy was applied to RG6. So for VNET1 the value is, it's own tags and azure policy tag that was applied to RG6 2ND - There was no tag assigned to VNET2. Forget about RGroup :RG6 tag because recourse group's tag is not inherited. As per Microsoft document, if no tag is applied to recourses, it add the label and value from the Recourse group's policy which was Label:Value1 in this case. Please read microsoft doc - Add a tag to resources ---> Adds the specified tag and value when any resource missing this tag is created or updated. Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed. Does not modify tags on resource groups.

Wrong VNET1: Department: D1 only VNET2: Label: Value1 only

Default tag policy comes into play when no tag has been applied. If vnet1 already had the tag department....the policy will no affect it. The policy will affect vnet2, policy will remediate/append the tag by adding the default tag; =value1

Wrong VNET1: Department: D1 only VNET2: Label: Value1 only

Finally the definitive answer. Thanks for sharing. VNET1 = Department:D1 VNET2 = Label: Value1

Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed. Does not modify tags on resource groups.

- Department: D1 only - Label: Value1 only

About "To RG6, you apply the tag: RGroup: RG6." I think it should be "Department: D1 and RGroup: RG6 only". Let me know if i'm wrong in some way

D1 Value1

Instead of manually applying tags or searching for resources that aren't compliant, you create a policy that automatically applies the needed tags during deployment. Tags can also now be applied to existing resources with the new Modify effect and a remediation task.

Correct is VNET 1 : Department D1 only VNET2 : Label value1 only Because VNET 1 Previous Exist then policy does not effect in other resources

Answer is correct, You use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of resources being deployed to your subscription that don't have the expected tags for your organization. Instead of manually applying tags or searching for resources that aren't compliant, you create a policy that automatically applies the needed tags during deployment. Tags can also now be applied to existing resources with the new Modify effect and a remediation task. The following section shows example policy definitions for tags.

D1 tag only and Value1 tag