Cloud governance strategy

Question 1

Explain the term governance

Answer 1

The term governance is the general process of establishing rules and policies and ensuring that they are enforced.

Question 2

What is the cloud adoption framework?

Answer 2

Provides proven guidance for companies that want to adopt the cloud.

It consists of tools, documentation and proven practices.

It provides the following stages:

1. Define your strategy
2. Make a plan
3. Ready your organisation
4. Adopt the cloud
5. Govern and manage your cloud environments

Question 3

Explain “Define your strategy” in the cloud adoption framework

Answer 3

Here you answer why you want to move to the cloud.

Eg. do you need to scale to meet demand? Will it reduce costs and increase business agility?

Question 4

Explain “Make a plan” in the cloud adoption framework

Answer 4

Build a plan that has actions that lead to the aspirational goals

Question 5

Explain “Ready your organisation” in the cloud adoption framework

Answer 5

Create an environment in the cloud to begin hosting workloads

Question 6

What are the 3 main factors to consider when creating a subscription strategy?

Answer 6

• Billing
• Access control
• Subscription limits

Question 7

Which level is a deploymen boundary for azure resources?
Management group?
Subscription?
Resource group?
Resource?

Answer 7

Subscription

Question 8

What are the maximum number of Azure Express routes per subscription?

Answer 8

10

Question 9

What are management groups used to manage?

Answer 9

A management group manages
*Access
*Policies and 
*Compliance 
across multiple azure subscriptions

Question 10

What scoped can RBAC be applied to?

Answer 10

Management groups
Subscriptions
Resource groups

Question 11

What are the was of accessing Azure Resource Manager?

Answer 11

Portal
CLI
Azure cloudshell
PowerShell

Question 12

On which pane you access RBAC?

Answer 12

“Access control (IAM)” pane

Question 13

How do you manage resource locks?

Answer 13

CLI, Portal, ARM templates, PowerShell

Question 14

What are the different lock types?

Answer 14

Read-Only - Can view the resource but cant modify or delete the resource
Delete - Prevents user from deleting the resource but can modify and view the resource

Question 15

How can you ensure that a resource inherits tags from it’s parent?

Answer 15

Use Azure policy

Question 16

How can you ensure that locks that are removed are automatically reinstated?

Answer 16

With Azure blueprints

Question 17

What are tags useful for?

Answer 17

Resource management - Tags enable you to locate and act on resources that are associated with specific workloads, environments, business units, and owners.

Billing reports - Tags enable you to group resources so that you can report on costs, allocate internal cost centers, track budgets, and forecast estimated cost.

Operations management - Tags can help to group resources according to how critical resource uptime is

Security - You can tag resources as public or confidential for example

Governance and regulatory compliance

Workload optimisation and automation - You can visualise resources that participate in complex deployments.

Question 18

What are the 3 steps involved in creating an azure policy?

Answer 18

1. Create a policy definition
2. Apply it to a resource
3. Review the evaluation results

Question 19

Policy definition examples

Answer 19

Allowed virtual machine SKUs

This policy enables you to specify a set of VM SKUs that your organization can deploy.

Allowed locations

This policy enables you to restrict the locations that your organization can specify when it deploys resources. Its effect is used to enforce your geographic compliance requirements.

MFA should be enabled on accounts with write permissions on your subscription

This policy requires that multifactor authentication (MFA) be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources.

CORS should not allow every resource to access your web applications

Cross-origin resource sharing (CORS) is an HTTP feature that enables a web application running under one domain to access resources in another domain. For security reasons, modern web browsers restrict cross-site scripting by default. This policy allows only required domains to interact with your web app.

System updates should be installed on your machines

This policy enables Azure Security Center to recommend missing security system updates on your servers.

Question 20

What is a policy initiative?

Answer 20

It is a way of grouping a number of policies into one set

Question 21

What are Azure blueprints?

Answer 21

Using Azure blueprints you can build a standard set of tools and resources that can be used by the organisation. It will ensure that what is deployed conforms and will comply with governance rules set by the organisation

Question 22

Are Azure blueprints versioned?

Answer 22

Yes