HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table:
You assign a policy to RG6 as shown in the following table:
To RG6, you apply the tag: RGroup: RG6.
You deploy a virtual network named VNET2 to RG6.
Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Correct answer is: VNET1 will only have Department: D1 tag & VNET 2 will only have Label : Value1 tag
are you referring to this answer? tag. vnet1 : departement D1 tag only. VNET1 - Department: D1 only VNET2 - Label: Value1 only
tag. vnet1 --- Department: D1 only. VNET1 - Department: D1 only VNET2 --- Label: Value1 only
By default, this assignment of newly create policy will only take effect on newly created resources. Existing resources can be updated via a remediation task after the policy is assigned.
Yes, you are right! :) https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies
Thanks for posting the link.
Thanks for posting the link.
this is wrong people do not like it!
Its not about OVERWRITTING... Its about the assignment of policy. The policy applies to resources that are created only after policy was applied but VNET1 is created before assigning the policy to Resource Group and for that reason VNET1 has only one tag which is Department : D1
no, you're wrong. VNET2 will have two tags, one is policy added and the other is what you specified when creating vnet2 RGroup:Value1
RGroup:Value1 tag only assigned to RG6 and it will not be replicated automatically to the resources on that RG
RGroup:Value1 tag only assigned to RG6 and it will not be replicated automatically to the resources on that RG
Yes, you are right! :) https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies
Thanks for posting the link.
Per tested, you are right!
Thanks for posting the link.
resources created before policy creation will not inherit the policy rules. so, VNET1 will only have Department: D1 tag, VNET 2 will have Label : Value1
Nope, VNET1 is already in place BEFORE the policy is created, so it doesn’t get the Label:value1 tag…
This is really easy to test. What came out of doing this for real (in the specific order that the question poses) with the policy "APPEND tag and its default value" is Vnet1 has only Department:D1, and Vnet2 has only Label:Value1. The text of the policy in the question does not match what is available in the policies in real life (append vs apply). In any case, here are the take-aways: Applying a tag to the resource group itself has no bearing on what the resources in the RG group get tagged with. Direct resource group tags are not inherited by resources in the group. Existing resources do not get the tagging applied when the policy is applied. Subsequent resources added after the policy is applied do get the tagging applied. It appears possible to create a policy that would create the tags on existing resources, but it requires usage of a managed identity; presumably this managed identity would be given access to modify the resources (as necessary to add and/or reset a tag+value).
In our group research with my partner Christian and I, we deployed the resources and we can confirm it. - that the answer to VNET1: is Department: D1 only - that the answer to VNET2: is Label1: Value1 only
RG tags are not inherited to resources. So VNET1 will have tags Department:D1 tag and VNET2 has NoTags
woah that's wrong. VNET2 is created after the policy, so VNET 2 will have the policy tag. VNET1 is created BEFORE the policy so it will have only Department tag.
Tag is only applied to the RG not its resources: "Apply tags and its default value" not "Append a tag and its value to resources"
Tag is only applied to the RG not its resources: "Apply tags and its default value" not "Append a tag and its value to resources"
test it in the lab VNET1 will only have Department: D1 tag & VNET 2 will only have Label : Value1 tag
u r right!
VNet1: Department: D1 only VNet2: Label: Value1 only Explanation: The built-in policy definition "Append a tag and its value to resources" appends the specified tag and value when any resource which is missing this tag is created or updated. Does not modify the tags of resources created before this policy was applied until those resources are changed. Does not apply to resource groups. reference: Assign policy definitions for tag compliance https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies
The correct answer is: VNET1 will only have Department: D1 tag VNET 2 will only have Label: Value1 tag
Tested in lab. The correct answer is: VNET1 will have Department:D1 VNET2 will have Label:Value1
VNET1= Department: D1 only VNET2= Label: Value1 only Policies only apply by default to newly created resources.
In my opinion: VNet1 have Department: D1 only tag VNet2 have Label: Value1 only tag
Hello all. I have reproduced the scenario and tested it, and the answers are: VNET1 Department : D1 only VNET2 Label : Value1 Only There is no aption to select on "policy definition" "Apply tag an its default valeu". There are only the options: Require a tag and its value on resources Append a tag and its value to resources Append a tag and its value to resources groups Require a tag and its value on resources groups Append a tag and its value from the resource group
Tested in a lab VNET1 - Department: D1 only VNET2 - Label: Value1 only
The correct answer is: VNET1 will only have Department: D1 tag VNET 2 will only have Label: Value1 tag The reason is : - vnet1 is created before policy creation, so tags won't change until you update the vnet1 resource - resource won't inherit tags from RG or subscription. refer: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json
Tested in lab VNET1 only has tag Department:D1 tag, because it was created before the policy assignment, if you want to modify an existing tag you should create a remediate task in the policy. VNET2 will have two tags, one is your specified tag RGroup:RG6, and the other one is policy specified Label:Value1 please note that the policy only adds a default tag for you but do not change the tags you specified when you create vnets.
Answers here are incredibly misleading even on relatively easy questions
Correct Answer should be: VNet1: Department: D1 only VNet2: Label: Value1 only
Correct answer is: Box1: Department D1 Only Box2: Label1 Only
Correct answer is: VNET1 => Department: D1 only option VNET2 => Label : Value1 only option
VNET1: Department=D1, VNET2: none. We should ignore the given PD because it is at RG level and is NOT inherited by VNET2.
Policy apply in RG6 Level-> tag Label: Value1 apply VNET1 and VNET2 VNET1 has already a tag Department:D1 and another tag come by applied policy at RG6 Level Label: Value1 total tag for VNET1 = epartment:D1 + Label: Value1 total tag for VNET2 = Label: Value1 Provided answer is correct
Most of you guys giving the wrong answer, the best way to found out is to test it on your lab. Just did the practical test on my lab and my result is: VNET1 = Department:D1 VNET2 = Label: Value1
VNET1 department D1 only, tags are not added afterwards
Answer os Vnet1 will only have D1 and Vnet 2 will have Value 1,By default, this assignment will only take effect on newly created resources. Existing resources can be updated via a remediation task after the policy is assigned. For deployIfNotExists policies, the remediation task will deploy the specified template. For modify policies, the remediation task will edit tags on the existing resources.
I agree with VNet1: Department: D1 only VNet2: Label: Value1 only
That's the correct answer: https://docs.microsoft.com/en-gb/azure/governance/policy/concepts/effects#append Policies do not touch already existing resources unless they get updated.
The Azure Policy scope is at the RG6 level. Since tags dont inherit from resource groups, would VNET2 have None?
No, VNET2 would have Label:Value1 because to newly added resources to RG6 the policy applies. The manually added tag set on RG6 will not inherited like you said.
Please correct the answer, VNET1 will only have Department:D1 tag and VNET will only have Label:Value1 tag , as tags are not even forced/applied by the policy. its only for the newly created resource , we need to adhere with the policy of the tags that defined in policy.
Discussions are having different answers then to the answer given on the portal. Which answer to follow in the end ?
https://learn.microsoft.com/en-us/azure/governance/policy/overview#understand-evaluation-outcomes "The following are the times or events that cause a resource to be evaluated: - A policy or initiative is newly assigned to a scope." So since the policy is newly assigned to the scope it gets applied right then. The remediation task is only needed if the policy ALREADY existed and was EDITED/UPDATED. So the given answers are correct. VNET1 = Department:D1 + Label: Value1 VNET2 = Label: Value1
Correct
Wrong VNET1: Department: D1 only VNET2: Label: Value1 only
VNET1: "Department: D1 only" VNET2: "Label: Value1 only"
Why doesnt VNet 1 have none as the tag?
VNet1: Department: D1 only VNet2: Label: Value1 only
Department: D1 only Label : Value1 only
question is incomplete: "Append a tag and itys value to resource" or "append a tag and its value to resource groups"?
can anyone help.. if tages are not inherited and it applied to to only RG6 then how it assigned to their resources (vnet and vnet 2 )??? vnet should be none(no tag)..
Because there is a tag policy here that actively adds the tag if it isn't there.
Answer provided is Correct https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources VNET1 = Department:D1 + Label: Value1 VNET2 = Label: Value1
No, that is incorrect. VNET1 already existed when the policy was deployed. It only had a tag Department: D1. Since the policy was deployed after VNET1, VNET1 will not be affected by the policy (no remediation task).
https://learn.microsoft.com/en-us/azure/governance/policy/overview#understand-evaluation-outcomes "The following are the times or events that cause a resource to be evaluated: - A policy or initiative is newly assigned to a scope." So since the policy is newly assigned to the scope it gets applied right then. The remediation task is only needed if the policy ALREADY existed and was EDITED/UPDATED. So the given answers are correct. VNET1 = Department:D1 + Label: Value1 VNET2 = Label: Value1
https://learn.microsoft.com/en-us/azure/governance/policy/overview#understand-evaluation-outcomes "The following are the times or events that cause a resource to be evaluated: - A policy or initiative is newly assigned to a scope." So since the policy is newly assigned to the scope it gets applied right then. The remediation task is only needed if the policy ALREADY existed and was EDITED/UPDATED. So the given answers are correct. VNET1 = Department:D1 + Label: Value1 VNET2 = Label: Value1
Correct is VNET 1 : Department D1 only VNET2 : Label value1 only Because VNET 1 Previous Exist then policy does not effect in other resources
About "To RG6, you apply the tag: RGroup: RG6." I think it should be "Department: D1 and RGroup: RG6 only". Let me know if i'm wrong in some way
VNET1: Inherits the policy tag (Label: Value1) Keeps its existing tag (Department: D1) Inherits the direct tag applied to RG6 (RGroup: RG6) Tags: Department: D1, RGroup: RG6, Label: Value1 VNET2: Inherits the policy tag (Label: Value1) Inherits the direct tag applied to RG6 (RGroup: RG6) Tags: RGroup: RG6, Label: Value1
correct answer is VNET 1 will only have Department:D1 and Vnet 2 none the policy is only applied on the RG an is not inherited by the vnet 1 or vnet2
Sammha83 and Armina are right. the given answer is wrong. It's all explained by them.
I think Answer is correct since Policy assignments are inherited by child resources. If policy is apply to RG6 it will take effect on all resources after running compliance check and remediation. So two tag will apply to vNET1 but will take affect only on remediation.
could you please clarify why RGGroup: RG6 tag not apply for VNET2 deploy as it is new deployment to apply effective policy right?
Tags are not inherited. The tag was only applied to the resource group, the VNET2 resource won't inherit it
Thank you!
This came in Exam Today, I cleared though .. Give the right authentic answer anyone , much appreciated... Not sure if the answer is right
Wrong answer. Resources do not inherit tags from resource groups unless specified, inheritance is not specified here.
Given answer is correct. "Modify" effect will update the tags every time when the resource is updated.
I don't see any Built-in Policy Definitions related to tags that have "Apply" on their name so this must be a custom one. Most of them will not modify the existing resources so you have to trigger the remediation task, and there are PDs does not apply to resource groups. So the answer is VNET1 will only have Department: D1 tag & VNET 2 will only have Label like Parmjeet answer.
Built-in policy will append a tag and its value from the resource group. So answers are correct.
From Udemy: Explanation 1. Tags applied to the resource group or subscription are not inherited by the resources. Existing resources can be remediated by triggering a remediation task. 2. The tags defined in the policy will be added while creating a new resource. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies
I think that the correct answer should be: VNET1 => Department: D1 only option VNET2 => RGroup: RG6, and Label : Value1 Read the "Choose between resource and inherited tags" part carefully : https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/enable-tag-inheritance
I read this part "To RG6, you apply the tag: RGroup: RG6." as being that that is what is being applied to the Label:Value1 in the policy. So then VNET 2 would only have RGroup:RG6. Or is the additional sentence an additional tag that is being applied to RG6 and the policy for some reason has Label: Value1.
A1: Department D1 and A2: Label : Value1 tag
VNET1 - Department: D1 VNET2 - Label : Value1
D1 tag only and Value1 tag
Answer is correct, You use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of resources being deployed to your subscription that don't have the expected tags for your organization. Instead of manually applying tags or searching for resources that aren't compliant, you create a policy that automatically applies the needed tags during deployment. Tags can also now be applied to existing resources with the new Modify effect and a remediation task. The following section shows example policy definitions for tags.
Instead of manually applying tags or searching for resources that aren't compliant, you create a policy that automatically applies the needed tags during deployment. Tags can also now be applied to existing resources with the new Modify effect and a remediation task.
Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed. Does not modify tags on resource groups.
Wrong VNET1: Department: D1 only VNET2: Label: Value1 only
Default tag policy comes into play when no tag has been applied. If vnet1 already had the tag department....the policy will no affect it. The policy will affect vnet2, policy will remediate/append the tag by adding the default tag; =value1
VNET1: Department: D1 only VNET2: Label: Value1 only