Examkin

Question

Difficulty: MediumAzure Policy

A company needs to ensure that all Azure SQL databases conform to a corporate security standard requiring Transparent Data Encryption (TDE) to be enabled. The IT security team wants to track and report on the compliance status of all databases across the subscription, but they do not want to block developers from deploying databases that do not meet this standard. Which of the following should the security team implement?

  1. An Azure Policy definition with the Audit effectAnswer
  2. B
    An Azure Policy definition with the Deny effect
  3. C
    An Azure Role-Based Access Control (RBAC) Reader assignment
  4. D
    A ReadOnly resource lock applied to the subscription

Answer

An Azure Policy definition with the Audit effect
The correct answer is the Azure Policy definition with the Audit effect. Azure Policy is designed to evaluate resource properties against corporate standards. The Audit effect evaluates resource configurations (such as whether SQL databases have TDE enabled) and logs non-compliance in the compliance dashboard, but it does not block the creation or modification of those resources, matching the company's requirements.

Step-by-Step Solution

1
Analyze the requirements to identify the core goal.
The goal is to track and report on database configurations (TDE enabled) without blocking deployments of non-compliant databases.
This establishes that the solution must focus on resource property evaluation (policy) rather than user access management (RBAC) or deletion/modification prevention (locks).
2
Evaluate the difference between Azure Policy effects.
The Audit effect evaluates resources and logs compliance status without blocking deployments, whereas the Deny effect actively prevents non-compliant deployments.
This distinguishes between the correct policy effect (Audit) and the incorrect policy effect (Deny) based on the requirement not to block developer deployments.
3
Compare policy-based compliance with other Azure governance features.
Azure Policy is the correct service for resource property evaluation. RBAC controls user permissions, and resource locks prevent accidental deletion or configuration changes.
This confirms that RBAC and resource locks are incorrect options for evaluating resource property compliance.

Key Concept

Azure Policy is used to define, assign, and manage policies that enforce different rules over resources, where the Audit effect evaluates resource properties and reports compliance without blocking deployments.
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy

More questions from this topic