Examkin

Question

Difficulty: MediumAzure Policy Governance

You are designing a governance strategy for an Azure environment. You need to implement an Azure Policy that enforces secure transport settings on Azure Cache for Redis instances. The policy must meet the following compliance requirements:

- Ensure that the minimum TLS version for all Redis instances is set to 1.2.
- If a new instance is deployed with an older version, or without specifying the version, the deployment must succeed, but the configuration must be automatically updated to enforce TLS 1.2.
- Existing non-compliant resources must be flagged in compliance reports but not modified automatically.

Which Azure Policy effect should you include in the policy definition to meet these requirements?

  1. ModifyAnswer
  2. B
    DeployIfNotExists
  3. C
    Deny
  4. D
    Audit

Answer

Modify
The correct answer is the Modify effect. The Modify effect allows Azure Policy to add, update, or remove properties or tags on a resource during creation or update. Since the requirement is to update the minimum TLS version property directly on the Azure Cache for Redis resource while allowing the deployment to succeed, the Modify effect is the most appropriate and efficient choice.

Step-by-Step Solution

1
Analyze the compliance goal to determine if non-compliant resource deployments should be blocked or corrected.
The requirement states that the deployment must succeed but the configuration must be automatically corrected to enforce TLS 1.2. This rules out the Deny effect.
Understanding the desired workflow helps narrow down the policy effects to those that perform remediation.
2
Identify the nature of the resource configuration change.
The change involves updating a direct property (minimum TLS version) on the resource under evaluation (Azure Cache for Redis) during creation or update.
Distinguishing between resource property modification and secondary resource deployment is necessary to choose between Modify and DeployIfNotExists.
3
Select the correct Azure Policy remediation effect based on the resource scope.
The Modify effect is selected because it is designed to alter properties directly on the evaluated resource during provisioning.
Using Modify avoids the administrative overhead of DeployIfNotExists, which is meant for template-based deployments of related resources.

Key Concept

Azure Policy effects determine the action taken when compliance rules are evaluated. The 'Modify' effect allows you to add, update, or remove properties directly on a resource during creation or update. In contrast, 'DeployIfNotExists' is used to deploy companion resources (like extensions or diagnostic logs) using ARM templates.
Rate this question

Topics

Azure Policy Governance

More questions from this topic