Practice question 494 of 498 · medium
A platform deny policy blocks a legacy workload requirement. The team proposes removing the entire security initiative from the common parent management group. The workload has a documented six-week remediation plan. Which action best preserves governed adoption?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Evaluate a narrowly scoped, time-bound exemption with an accountable risk owner, compensating controls, and monitored remediation
Evaluate a narrowly scoped, time-bound exemption with an accountable risk owner, compensating controls, and monitored remediation: This treats the justified workload exception without weakening unrelated controls across the estate. Remove the common initiative from all subscriptions until the legacy team finishes: This exposes unrelated workloads to the same governance gap. Move the workload into an unmonitored subscription with no exception record: That avoids governance rather than managing risk. Give the deployment identity broader RBAC and assume it overrides a deny policy: More role permissions do not generally bypass applicable Policy deny enforcement. Rename the blocked resource so the documented exception becomes unnecessary: Naming does not reliably change the requirement or its policy condition.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.