Humongous Insurance assigns a policy initiative at the tenant root management group that denies the creation of public IP addresses. A subscription named Sub-Lab is used for a proof of concept and must be allowed to create public IP addresses for the next 90 days only, after which the restriction must return automatically. You must not change what the assignment enforces anywhere else. What should you create?
- A.
A second assignment of the same initiative on Sub-Lab with the effect set to Audit
- B.
A new management group for Sub-Lab that has no policy assignment
- C.
A policy exemption on Sub-Lab with an expiry date 90 days from now
- D.
An excluded scope for Sub-Lab on the existing policy assignment
Show answer
Answer: C
Only a policy exemption supports an expiry date, so the restriction returns automatically after 90 days without anyone remembering to act.
- A. A second assignment cannot weaken an inherited one; when several assignments apply, the most restrictive effect, Deny, wins.
- B. Assignments made at the tenant root management group are inherited by every descendant, so a new management group would still inherit the Deny.
- C. Exemptions are separate objects that support an expiresOn date, so enforcement resumes automatically when the waiver lapses.
- D. An excluded scope has no expiry and requires editing the tenant root assignment, so the restriction would never return by itself.