Exam AZ-301 topic 2 question 6 discussion

Actual exam question from Microsoft's AZ-301

Question #: 6
Topic #: 2

Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains a resource group named RG1.
You create an Azure Active Directory (Azure AD) group named ResearchUsers that contains the user accounts of all researchers.
You need to recommend a solution that meets the following requirements:
✑ The researchers must be allowed to create Azure virtual machines.
✑ The researchers must only be able to create Azure virtual machines by using specific Azure Resource Manager templates.
Solution: On RG1, assign the Contributor role to the ResearchUsers group. Create a custom Azure Policy definition and assign the policy to RG1.
Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: A 🗳️

by mykolaantoniv at Feb. 16, 2020, 12:28 p.m.

Comments

Submit Cancel

Avanade2023

Highly Voted 5 years, 1 month ago

Can anyone tell me how to realize "The researchers must only be able to create Azure virtual machines by using specific Azure Resource Manager templates." by a custom Azure Policy? I think that Azure Policy can be used to restrict VM's status like SKU sizes, location or adding a tag. But Azure Policy cannot be used to restrict any actions like above. Wouldn't we use RBAC?

upvoted 8 times

milind8451

5 years, 1 month ago

Ans for your ques - https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-custom-policy-definition

upvoted 1 times

Test_Taker

4 years, 10 months ago

I dont think that link answers the question. That link uses ARM templates as a means to find the name of the property on a resource that you want to control via Azure Policy. It doesn't say that you can or how you can restrict to a specific ARM template. At least as far as i can find.

upvoted 2 times

...

mykolaantoniv

Highly Voted 5 years, 4 months ago

"Yes" is the correct answer

upvoted 7 times

tartar

4 years, 9 months ago

A is ok

upvoted 3 times

...

Aghora

Most Recent 4 years, 4 months ago

No - read my comments on previous questions

upvoted 1 times

5 years ago

it should be: NO As contributor can use all types of templates instead you need to create a lab and assign dev/test lab user role https://docs.microsoft.com/en-us/azure/lab-services/devtest-lab-use-resource-manager-template As per this article it says that there are two types of templates: 1- Resource Manager templates that use a Microsoft.DevTestLab/labs/virtualmachines resource type.....and this can't be used by DevTest Labs user role 2- Resource Manager templates that use a Microsoft.Compute/virtualmachines resource type .... Users who are assigned with a DevTest Labs user role can create environments using those templates as long as the administrator has configured the lab that way. so this should achieve the target of using only specific templates

upvoted 5 times

mtb123

5 years ago

"Create a custom Azure Policy definition and assign the policy to RG1." " This should be where the restrictions on templates are set

upvoted 3 times

...

yefeimail

5 years, 1 month ago

yes for sure it is yes. no doubt

upvoted 2 times

...