Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →easyMultiple ChoiceObjective-mapped

AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

Exhibit

{
  "properties": {
    "enforcementMode": "Default",
    "scope": "/subscriptions/abc123/resourceGroups/RG-Prod",
    "notScopes": [
      "/subscriptions/abc123/resourceGroups/RG-Prod/providers/Microsoft.Compute/virtualMachines/VM-Sensitive"
    ]
  }
}

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.

'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources. Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy will apply only to the VM-Sensitive virtual machine.
Why it's wrong here
This misreads the assignment's notScopes as the target of the policy. The assignment is scoped to RG-Prod, so every resource in that resource group is within the policy's evaluation scope; notScopes only carves out one VM. A resource-group-level assignment cannot be reduced to a single virtual machine by using exclusions.
✗
The policy will apply to all resources in RG-Prod except the entire resource group.
Why it's wrong here
This conflates an excluded child resource with the assignment scope itself. notScopes accepts specific resource IDs within RG-Prod and cannot exclude the resource group that is the scope, because that would make the assignment empty and logically invalid. Therefore, the policy cannot apply to all resources except the entire RG—the scope already is RG-Prod.
✓
The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.
Why this is correct
The assignment's scope is RG-Prod, making every contained resource subject to policy evaluation. The notScopes array specifies the VM-Sensitive virtual machine resource ID, so that VM alone is excluded from compliance evaluation. All other resources, regardless of type, remain within the assignment's scope and are evaluated.
✗
The policy will apply to the subscription but not to RG-Prod.
Why it's wrong here
The assignment is explicitly defined at the RG-Prod resource group scope, not at a management group or subscription level. Azure Policy assignments are evaluated against their declared scope, so a resource-group-level assignment does not propagate to the subscription or apply to any resources outside RG-Prod. notScopes removes only a child resource; it does not widen the assignment scope.

Go deeper

AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question