Exam AZ-104 All Questions

View all questions & answers for the AZ-104 exam

Exam AZ-104 topic 3 question 7 discussion

Actual exam question from Microsoft's AZ-104

Question #: 7
Topic #: 3

HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.

The status of VM1 is Running.
You assign an Azure policy as shown in the exhibit. (Click the Exhibit tab.)

You assign the policy by using the following parameters:
Microsoft.ClassicNetwork/virtualNetworks
Microsoft.Network/virtualNetworks
Microsoft.Compute/virtualMachines
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

by idlir at Nov. 30, 2020, 11:09 p.m.

Comments

Submit Cancel

bogdan89

Highly Voted 4 years, 6 months ago

Y-N-N tested today in a LAB.

upvoted 217 times

Alcpt

3 weeks, 5 days ago

Once the deny policy is applied to rg2, you cannot move a denied vnet type into a blocked rg scope. Why is it not NNN

upvoted 1 times

...

58b2872

5 months, 2 weeks ago

N- When you move a VM to a RG2, it is like creating a new VM, so the policy will prevent that for sure, no resource's modification or creation is allowed..... Y- VM1 is already created, so it won't get affected in the policy, new creation or modification will not be allowed, not deallocating the existed ones... N since I am modifying something in the resource newly, which is not allowed duo of the policy.... so the suggested answer by EXAMTOPICS is TRUE !!!

upvoted 1 times

...

vrm1358

5 months, 2 weeks ago

Tested IN lab Jan 2025 N,N,N

upvoted 7 times

...

comin

3 years, 11 months ago

The answer is wrong. Just did the test following the same structure as in the question and the answer they give is correct. Answer: N Y N Why wouldn't the VM state change to deallocated? You just can't make changes in the Settings section.

upvoted 9 times

Mozbius_

3 years, 4 months ago

Policies don't make changes. They only mark already existing resources as non-compliant unless you setup a remediation which is not done by default. Policies affect new resources. I wasn't sure about changes done to already existing resources but it makes sense that policies also apply changes done after applying a policy. That's a topic found even in AZ-900.

upvoted 10 times

Mozbius_

3 years, 4 months ago

**that policies also apply to changes done after applying a policy

upvoted 3 times

...

Sanaz90

10 months, 4 weeks ago

His answer is completely incorrect. It's NO NO NO. tested in lab.

upvoted 3 times

...

MrJJ10

2 years, 5 months ago

VM1 never changed...its in RG2....nothing says its connected to VNET1 (VNET1 is RG1)....the policy is set for RG2

upvoted 1 times

...

Load full discussion...

...

idlir

Highly Voted 4 years, 6 months ago

N-N-N Policy will identify the VM as not compliant but will not put VM in deallocate

upvoted 162 times

ostych

3 years, 2 months ago

Agreed, tested in a lab.

upvoted 3 times

...

Anon6969

4 years, 6 months ago

This makes the most sense. Only one I am not sure on is how the policy would modify the change to the address space?

upvoted 4 times

...

prashantjoge

4 years, 6 months ago

I agree. Existing non-compliant resources can be remediated with a remediation task. But no action is taken against them other than to mark them as non-compliant

upvoted 5 times

...

Baconrind

3 years, 2 months ago

Agree with N-N-N, trying to move VNET1 to RG2 gives 'disallowed by policy' error after validation checking. Modifying address space fails with 'Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy. '

upvoted 8 times

...

Load full discussion...

...

marek_jazz

Most Recent 1 month ago

N N N 1. Cannot make modifications to uncompliant resources 2. VM state doesn't change based on Azure policy 3. Cannot modify a resource with Deny policy for its existence Azure Policy is preventative, not corrective unless you manually apply remediation tasks (and this specific policy doesn’t support remediation). Compliance status helps monitor governance, but it doesn’t enforce state changes retroactively.

upvoted 1 times

...

MrMoris

4 months ago

N-N-N Tested in my lab. lots if comments said that you are able to change the address space even with the policy, but it's not possible. The policy prevents you from doing that!

upvoted 1 times

...

witalis

6 months, 4 weeks ago

N- restricted by policy N - no changes N - yes, you can make changes on ressources that restricted by policy

upvoted 4 times

...

sca88

7 months ago

Answer should be NNY. The policy don't allow the creation of new resources in RG2 like VM and VNET, but it doesn't affect the already created resources. So 1 and 2 is NO. The number 3 is YES, because the policy doesn't affect the administrator to edit the resources. Nobody can be create a new VNET, but admin can modify existing one.

upvoted 2 times

...

christovski

7 months, 3 weeks ago

Answer given is correct. N-Y-N 1. I am given the error Resource 'VNET1' was disallowed by policy 2. Virtual Machine deallocated without an issue 3. Error message: Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy

upvoted 4 times

...

TodRose

7 months, 4 weeks ago

The correct answers are: 1. No 2. No 3. No When you apply a policy that restricts certain resource types (e.g., Microsoft.Network/virtualNetworks and Microsoft.Compute/virtualMachines), it only prevents the creation of new resources of those types after the policy is enforced. Here's how it affects your existing resources: 1. State of VM1 (existing virtual machine): The existing VM1 will remain unaffected. Azure Policy works as an allow/deny mechanism during the creation or modification of resources. It does not retroactively delete or modify existing resources that were created before the policy was applied. So, VM1 will continue to run normally after the policy is applied. 2. Changing the address space of the VNet: Since the policy prevents actions on Microsoft.Network/virtualNetworks, you would not be able to modify the address space of the existing VNet. The policy will block updates or changes to the VNet because it restricts actions on resources of that type.

upvoted 2 times

...

kejo2

8 months, 2 weeks ago

Justed tested this in my LAB. The answer is N,N,N Failed to save virtual network changes Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types","id":"/subscriptions/4b52c793-3612-4942-a61f-2caf2d665ccf/resourceGroups/RG2/providers/Microsoft.Authorization/policyAssignments/0fa54e46d93e48dd9c72f3a1"},"policyDefinition":{"name":"Not allowed resource

upvoted 3 times

...

Mshaty

8 months, 2 weeks ago

the answer is N_N_Y since the policy restricts creation of new resources and does not affect the resources that already in the resource group

upvoted 3 times

...

[Removed]

9 months, 2 weeks ago

WRONG No No No

upvoted 2 times

...

radouani

10 months, 2 weeks ago

If you are confused about all those comments, The answer is NO, NO, NO, I have just tested on my azure account. When you create the policy, you should give it 10mn at least to show non compliant resources. 1. Resource move policy validation failed. Please see details. Diagnostic information: Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types","id":"/subscriptions/....... 2. The VM still running, I thought that it has restarted but no, it is still running 3. Failed to save address space changes to virtual network 'VNET2'. Error: Resource 'VNET2' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types"......

upvoted 6 times

...

Surs

10 months, 2 weeks ago

Tried this out. Answer > NYN An Administrator can move VNet1 to RG2 > NO [Error > Resource move policy validation failed. Resource 'VNet1' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types"] The state of VM1 changed to deallocated > YES [ Was able to stop the VM. Was also able to start the VM] An administrator can modify the address space of VNet2 > NO [Error > Failed to save address space changes to virtual network 'VNet2'. Error: Resource 'VNet2' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Not allowed resource types"]

upvoted 3 times

...

Y2

11 months ago

N-N-N Tested in lab, A - Cannot add a V-Net to the RG B- the VM's status will not be changed to deallocated C- Cannot modify Address space of V-Net in the RG

upvoted 1 times

...