Examkin

Question

Difficulty: MediumAzure Policy Governance

A financial services firm, FinSecure Corp, is designing an Azure governance framework for its production subscriptions. The security team establishes two compliance mandates:

1. Prevent the deployment of any virtual machines that have public IP addresses directly associated with their network interfaces.
2. Ensure that all newly deployed virtual networks are automatically configured with diagnostic settings that send all network metrics to a central Log Analytics workspace.

You need to recommend the appropriate Azure Policy effects to satisfy these mandates with the least administrative effort.

Which two policy effects should you recommend?

  1. The DeployIfNotExists effect for the virtual network diagnostic settings mandateAnswer
  2. The Deny effect for the virtual machine public IP mandateAnswer
  3. C
    The Deny effect for the virtual network diagnostic settings mandate
  4. D
    The Audit effect for the virtual machine public IP mandate

Answer

DeployIfNotExists for the virtual network diagnostic settings mandate, and Deny for the virtual machine public IP mandate.
The correct options are DeployIfNotExists for the virtual network diagnostics mandate and Deny for the virtual machine public IP mandate. The Deny effect blocks the creation of resources that violate policy definitions, making it ideal for preventing public IP association on virtual machines. The DeployIfNotExists effect evaluates the resource configuration and automatically deploys secondary resources (such as diagnostic settings linked to a Log Analytics workspace) if they are missing, ensuring automated governance without blocking primary resource deployment.

Step-by-Step Solution

1
Analyze the virtual machine requirement
The requirement is to prevent the deployment of VMs with public IPs.
Since the goal is to stop non-compliant resource creation, the Deny policy effect is the standard governance tool to block these deployments.
2
Analyze the virtual network diagnostics requirement
The requirement is to automatically configure diagnostic settings for new virtual networks.
Diagnostic settings are secondary resources. DeployIfNotExists (DINE) evaluates resources, and if a child/related resource (like diagnostic settings) is missing, it deploys it automatically.
3
Verify administrative overhead constraints
Using Deny for the VM mandate blocks violation at source. Using DeployIfNotExists for the virtual network mandate automatically remediates the configuration without blocking deployments, minimizing developer overhead.
Choosing Deny for diagnostic settings would disrupt deployments and require manual template configuration, while Audit would require manual remediation tasks.

Key Concept

Azure Policy effects determine how resources are evaluated and governed, using Deny to block non-compliant resources and DeployIfNotExists to automate secondary resource creation.
Rate this question

Topics

Azure Policy Governance

More questions from this topic