Examkin

Question

Difficulty: HardSecurity, Governance, and Manageability

A financial services firm is designing its Azure governance and manageability strategy to satisfy strict regulatory compliance. The firm needs to automate and standardize resource deployments using declarative configuration, prevent accidental deletion of production virtual machines while allowing administrators to start and stop them, and restrict all resource deployments to a specific geographical region. Which combination of Azure features should the firm implement to meet these requirements?

  1. A
    Azure Resource Manager (ARM) templates, ReadOnly locks, and Azure Policy
  2. B
    Azure CLI scripts, Delete locks, and resource tags
  3. Azure Resource Manager (ARM) templates, Delete locks, and Azure PolicyAnswer
  4. D
    Azure Resource Manager (ARM) templates, Delete locks, and Azure Role-Based Access Control (RBAC)

Answer

Azure Resource Manager (ARM) templates, Delete locks, and Azure Policy
The correct answer combines Azure Resource Manager (ARM) templates, Delete locks, and Azure Policy. ARM templates satisfy the declarative deployment requirement. Delete locks prevent resource deletion while permitting administrators to change the operational state of VMs (starting and stopping). Azure Policy enforces compliance by restricting resource creation to allowed regions.

Step-by-Step Solution

1
Analyze the resource deployment automation requirement.
Azure Resource Manager (ARM) templates are chosen because they are declarative, whereas Azure CLI scripts are imperative.
Declarative templates specify the desired end state, ensuring reliable, standardized, and automated deployments.
2
Analyze the access and safety requirement for production virtual machines.
A Delete lock is selected rather than a ReadOnly lock.
A Delete lock prevents deletion but allows control plane operations like starting and stopping virtual machines. A ReadOnly lock is too restrictive because it blocks write and action operations, preventing VMs from being started or stopped.
3
Analyze the regional compliance requirement.
Azure Policy is selected to restrict the regions where resources can be deployed.
Azure Policy actively enforces compliance rules (such as allowed regions), whereas resource tags only provide metadata and Role-Based Access Control (RBAC) only controls who has access to perform actions.

Key Concept

Azure Governance and Compliance Tools
Estimated Time:2m 0s
Rate this question

Topics

Security, Governance, and Manageability

More questions from this topic