Azure Policy Hierarchy and Exemption Logic
Short answer
Yes, No, No. The tagging policy applies to KV1 via Finance hierarchy inheritance; the allowed-locations policy does not reach SQL1 in the Prod subscription; and the DB1 exemption overrides the tagging policy in RG6.
Question
You have five Azure subscriptions as shown in the following table.
You have the resource groups shown in the following table.
You have the Azure resources shown in the following table.
You create the Azure Policy assignments shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Key Takeaways
Policies inherit down but never up or across sibling subscriptions; explicit exemptions always override inherited assignments.
Determines Azure Policy applicability by tracing hierarchy from Management Groups to resources, accounting for subscription boundaries and exemptions.
Common mistake: Assuming policies assigned to a Management Group apply to all resources regardless of subscription context, or ignoring that exemptions take precedence over assignments.
Expert Analysis
Azure Policy enforcement follows a strict hierarchical inheritance model: Management Groups > Subscriptions > Resource Groups > Resources. To determine if a policy applies, trace the path from the assignment scope down to the target resource.
For Statement 1 (Resource Tagging on KV1): The policy is assigned at the Finance Management Group level. Since Subscription3 is part of the Finance hierarchy, and RG4 is inside Subscription3, and KV1 is inside RG4, the policy applies. Answer: Yes.
For Statement 2 (Allowed Locations on SQL1): The policy is assigned directly to the Dev subscription. However, SQL1 resides in RG5. RG5 is located in the Prod subscription. Because Azure Policy assignments do not cross subscription boundaries unless explicitly inherited through a parent management group, the Dev subscription policy does not apply to resources in the Prod subscription. Answer: No.
For Statement 3 (Policy Exemption on DB1): The policy is assigned to the Finance Management Group. DB1 is in RG6, which is in Subscription2 (Finance). However, an exemption was created specifically for RG6. Exemptions override policy assignments within their scope. Therefore, the policy does not enforce on DB1. Answer: No.
Official Reference
https://learn.microsoft.com/en-us/azure/governance/policy/concepts/exemption-structure
This link opens the official vendor documentation in a new tab.
Exam Strategy
When analyzing policy questions, draw a quick hierarchy tree. Start at the assignment scope and trace down. Check two critical blockers: 1) Is the resource in a different subscription than the policy's direct scope? 2) Is there an explicit exemption at the resource, resource group, or subscription level? If either blocker exists, the policy does not apply.
Frequently Asked Questions
Does Azure Policy inherit from Management Groups to all child subscriptions?
Can a policy assigned to a Subscription affect another Subscription?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
AllanHouston 👍 1Resource tagging policy applies to KV1: True The Resource tagging policy is assigned to the Finance management group. Subscription3 belongs to Finance. RG4 belongs to Subscription3. KV1 belongs to RG4. Azure Policy assignments flow down the resource hierarchy from management groups to child subscriptions, resource groups, and resources. Therefore, the policy applies to KV1. InternalCharge = True cost data includes VM1: False VM1 is in RG1. RG1 is in Subscription2. Subscription2 has InternalCharge: False, not True. Moving Subscription4 to Marketing causes VM2 to shut down: False Moving Subscription4 under Marketing would bring VM2 into the scope of the Deny creation of virtual machines policy. However, a deny policy prevents new or updated noncompliant deployments. It does not shut down or delete an existing VM merely because the VM enters the policy scope.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →