Azure Policy Assignments: How Do PA1, PA2, and PA3 Apply?

Why the Answer Is Correct

Azure Policy assignments take effect at their assignment scope and cascade down the entire management group hierarchy, so an assignment made at MG1 reaches every subscription and resource group beneath it — including Sub2 and Sub4 — which makes any statement restricting PA1 to Sub2 alone false. The resource selector added to PA2 is an assignment-level filter of kind Microsoft.Compute/virtualMachines with an East US location condition, so the policy definition itself is unchanged while evaluation is limited to virtual machines in that region; resources of other types or in other regions are skipped. Adding Sub1 as an exclusion to PA3 puts Sub1 in the assignment's excluded scopes, so PA3 still applies everywhere else in its scope but no longer evaluates Sub1 resources. The three actions therefore map one-to-one onto the three statement rows: PA1 broadens beyond Sub2 (No), PA2 becomes East US VM-only (Yes), and PA3 stops applying to Sub1 (Yes).

Why Other Candidate Answers Are Wrong

Answering Yes to the PA1 statement confuses the scope of the assignment with the subscription that happens to host the workloads; the assignment is anchored at MG1, not at Sub2, and inheritance is automatic. Another wrong path treats the resource selector as if it edited the PA2 definition or as if location filtering required a separate 'Allowed locations' policy — a resource selector only narrows which resources the existing assignment evaluates. Candidates also err by assuming an exclusion disables or deletes PA3 outright, or that a subscription cannot be excluded from a management-group-scoped assignment; exclusions are child scopes of the assignment scope, so Sub1 is a valid exclusion for a policy that cascades over it. Finally, some answers assume policy evaluation is manual or requires remediation before taking effect, but audit and deny effects apply at evaluation time, not at remediation time.

Community Comment Notes

The single high-voted comment on this scenario, from gpais, is a correction breakdown rather than a defense of the original selection, and it states that "MG1 is the direct parent container for both Sub2 and Sub4," then justifies the No verdict with "Because Azure Policy evaluations automatically inherit down to all child scopes" — a concise restatement of exactly the inheritance rule the exam is probing. gpais also notes that PA1 assigns at management group MG1, so the assignment "will evaluate resources across both subscriptions, not" just Sub2. There is no meaningful vote distribution to lean on here (votes recorded as n/a), so the verdict rests on documented Azure Policy scope and inheritance behavior rather than on learner consensus.

Exam Strategy

For every policy hotspot, write down the assignment scope, then the selectors, then the exclusions, before judging any statement — most wrong answers come from skipping the scope step. Remember that inherited assignments are evaluated identically at every child scope, so only an explicit exclusion or a non-inherited scope removes a subscription from evaluation.