Examkin

Question

Difficulty: EasyMonitoring and Log Routing Solutions

Your company is designing a monitoring solution for resources deployed in Azure. You need to ensure that all newly created Azure Key Vaults automatically have diagnostic settings enabled to route logs to a centralized Log Analytics workspace. If a Key Vault is deployed without diagnostic settings, the settings must be created automatically without preventing the deployment of the Key Vault itself. Which Azure Policy effect should you select to meet these requirements?

  1. Create an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings automatically.Answer
  2. B
    Create an Azure Policy with the Deny effect to prevent Key Vault deployment unless diagnostic settings are already configured.
  3. C
    Deploy a separate Log Analytics workspace for each individual Key Vault and manually configure the settings by assigning permissions directly to developer user accounts.
  4. D
    Create an Azure Policy with the Audit effect to flag non-compliant Key Vaults, and deploy a new Log Analytics workspace for every new resource group to keep workspaces isolated.

Answer

Create an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings automatically.
The correct answer is to use the DeployIfNotExists policy effect. In Azure Policy, when you need to ensure that a resource (such as a Key Vault) has a diagnostic setting configured, but you do not want to block the deployment of the resource itself, DeployIfNotExists is the standard effect. It checks if the diagnostic setting sub-resource exists. If it does not, the policy runs a template deployment to create the diagnostic setting and route logs to the central Log Analytics workspace.

Step-by-Step Solution

1
Identify the primary requirement for configuring diagnostic settings.
Diagnostic settings must be automatically created when a Key Vault is deployed without them.
This establishes that a reactive or automatic remediation mechanism is required.
2
Evaluate the deployment constraints.
The policy must not prevent or block the deployment of the Key Vault.
This rules out the Deny effect, which blocks non-compliant resource creation.
3
Choose the correct Azure Policy effect and architecture.
The DeployIfNotExists effect is the standard policy effect for automatically deploying child resources like diagnostic settings without blocking the parent resource.
DeployIfNotExists allows the resource to be deployed first, then evaluates and applies the template to deploy the diagnostic settings.

Key Concept

Automating log routing and diagnostic setting enforcement using Azure Policy effects.
Rate this question

Topics

Monitoring and Log Routing Solutions