Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Refer to the exhibit.

{
  "properties": {
    "policyDefinitions": [
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bfd4f8c3-4b5d-4a7d-8c9a-1e2f3a4b5c6d",
        "parameters": {
          "effect": {
            "value": "Deny"
          },
          "allowedLocations": {
            "value": ["eastus", "westus"]
          }
        }
      }
    ],
    "policySetDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d"
  },
  "id": "/subscriptions/sub123/resourceGroups/rg-devops/providers/Microsoft.Authorization/policyAssignments/assignment-dev",
  "type": "Microsoft.Authorization/policyAssignments",
  "name": "assignment-dev",
  "location": "eastus"
}

You are reviewing an Azure Policy assignment in a DevOps environment. The exhibit shows the policy assignment JSON. The policy set includes the built-in policy 'Allowed Locations' with effect Deny. During a pipeline deployment, a resource creation fails with a policy violation error. The resource being deployed is a storage account in the 'centralus' region. What is the most likely reason for the failure?

⚠ Common exam trap

Many exam-takers assume the resource group's location influences policy evaluation, but Azure Policy evaluates each resource's location independently, and the resource group's location is irrelevant unless explicitly referenced in the policy rule.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The resource being deployed is in a region that is not allowed by the policy assignment parameters.

The policy assignment includes the built-in 'Allowed Locations' policy with the Deny effect. The resource being deployed (a storage account) is in the 'centralus' region, but the policy assignment parameters likely specify a list of allowed regions that does not include 'centralus'. Since the Deny effect prevents any non-compliant resource creation, the deployment fails with a policy violation error. This is the most direct and common cause of such failures in Azure Policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy assignment is misconfigured because it does not specify a policy set definition.
Why it's wrong here
The assignment includes a policySetDefinitionId, so it is correctly configured. Azure Policy assignments can reference either a policy definition or a policy set definition (initiative), and the presence of a policySetDefinitionId makes the assignment valid, not misconfigured.
✓
The resource being deployed is in a region that is not allowed by the policy assignment parameters.
Why this is correct
The allowedLocations parameter in the policy assignment restricts permissible deployment regions to eastus and westus only. Since the resource being deployed is in centralus, which is not included in those parameters, the 'Allowed Locations' policy denies the deployment as non-compliant.
✗
The resource group is located in a region that overrides the policy assignment.
Why it's wrong here
Resource group location does not override policy assignments. Azure Policy evaluates each resource based on its own location and the policy parameters, regardless of where the containing resource group is deployed, so the resource group's region has no effect on whether the policy applies.
✗
The policy set definition does not include the 'Allowed Locations' policy.
Why it's wrong here
The assignment includes the policy definition ID for 'Allowed Locations' as part of the policy set definition, confirming it is included. Therefore, the statement that the policy set definition does not include the Allowed Locations policy is factually incorrect.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question