Examkin

Question

Difficulty: MediumAzure Policy Governance

Nebula Diagnostics is designing an Azure governance solution. The compliance team mandates that all newly created Azure Virtual Machines must have the Azure Monitor Agent installed. The virtual machine deployment must not be blocked if the agent is missing at the time of creation; instead, the agent must be deployed and configured automatically post-deployment.

Which Azure Policy effect should you recommend to meet these requirements?

  1. DeployIfNotExistsAnswer
  2. B
    Modify
  3. C
    Deny
  4. D
    Audit

Answer

DeployIfNotExists
The DeployIfNotExists effect is the correct choice because it evaluates compliance after a resource is created or updated, and then deploys a template (such as the Azure Monitor Agent extension) if the resource is found to be non-compliant. This ensures that the virtual machine deployment is not blocked and compliance is achieved automatically.

Step-by-Step Solution

1
Analyze the compliance requirement.
The requirement states that the Azure Monitor Agent must be installed and configured automatically for all new virtual machines.
This establishes that automated remediation is required rather than simple logging or manual intervention.
2
Analyze the deployment flow constraint.
The virtual machine creation must not be blocked, which rules out preventative effects.
Preventing resource creation directly is handled by the Deny effect, which cannot be used here because the virtual machine deployment must be allowed to succeed first.
3
Select the policy effect that deploys resources dynamically.
Identify DeployIfNotExists as the correct effect for template-based resource deployment (such as VM extensions) that triggers after a resource is successfully created or updated.
DeployIfNotExists allows the VM to be deployed first, then evaluates compliance and deploys the Azure Monitor Agent extension if it is missing, matching all requirements.

Key Concept

Azure Policy Effects for Automated Remediation
Rate this question

Topics

Azure Policy Governance

More questions from this topic