Describe the concepts of security, compliance, and identity →hardMultiple SelectObjective-mapped

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

{
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "resources": [
            {
                "type": "Microsoft.Authorization/policyAssignments",
                "apiVersion": "2021-06-01",
                "name": "audit-sql-encryption",
                "properties": {
                    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f",
                    "parameters": {
                        "effect": {
                            "value": "AuditIfNotExists"
                        }
                    }
                }
            }
        ]
    }

Refer to the exhibit. An administrator deploys this Azure Resource Manager template. Which TWO of the following statements are true?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy assignment audits whether SQL Database transparent data encryption is enabled.

The policy definition ID corresponds to 'Audit if SQL Database encryption is not enabled'. The effect is 'AuditIfNotExists', so it audits but does not enforce. The assignment is at subscription/management group scope, not resource group. It does not deploy a resource but assigns a policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The template creates a resource group if it does not exist.
Why it's wrong here
This ARM template is designed to deploy a policy assignment, not to create a resource group. Azure Resource Manager templates typically deploy resources *into* an existing resource group or at a higher scope like a subscription or management group. For a template to create a resource group, it would need to be deployed at the subscription level and explicitly include a resource of type 'Microsoft.Resources/resourceGroups', which is not present in a policy assignment template.
✗
The policy assignment enforces encryption on existing SQL databases.
Why it's wrong here
The policy assignment uses the 'AuditIfNotExists' effect, which is designed to identify and report on non-compliant resources without making any modifications. To enforce encryption, the policy effect would need to be 'DeployIfNotExists' (which would deploy a remediation to enable TDE) or 'Deny' (which would prevent the creation of non-compliant SQL databases). Therefore, this policy only audits the compliance state, it does not enforce encryption on existing SQL databases.
✗
The template deploys a new SQL database.
Why it's wrong here
The template's primary resource type is 'Microsoft.Authorization/policyAssignments', indicating its sole purpose is to assign a governance policy. It does not contain any resource definitions for 'Microsoft.Sql/servers/databases' or similar types that would be required to provision a new SQL database. Its function is purely declarative for policy management, not for deploying data plane resources like databases.
✓
The policy assignment audits whether SQL Database transparent data encryption is enabled.
Why this is correct
The policy definition ID referenced in the assignment corresponds to a built-in Azure Policy that specifically checks for Transparent Data Encryption (TDE) on SQL databases. Combined with the 'AuditIfNotExists' effect, this policy assignment will scan existing SQL databases within its scope and report any instances where TDE is not enabled, making them visible in the Azure Policy compliance dashboard.
✓
The policy assignment can be deployed to a subscription or management group.
Why this is correct
Azure Policy assignments are designed to apply governance across broad organizational structures. The 'Microsoft.Authorization/policyAssignments' resource type supports deployment at the subscription scope, which applies the policy to all resources within that subscription. Furthermore, it can be deployed at a management group scope, which extends the policy's reach to all subscriptions and resources hierarchically beneath that management group, enabling centralized governance.

Go deeper

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question